News & Views

50 � Division of Chemical Hea

Elsevier Inc. All rights reserv

Chemical facilities antiterrorismstandard

B y the time this column is published,the Department of Homeland Secur-ity should have published the final,

interim list of chemicals regulated under theApril 9, 2007 regulation.1 When the list wasfirst published, many of us who carefully watchgovernment regulatory activity were shocked.Many common research chemicals, including,for example:

Hydrogen chloride(anhydrous)

Phosphorousoxychloride2

Hydrogen sulfide Sulfur dioxidePhosphorous Triethanolamine

3 DHS has directly contacted facilities which it

were included with ‘‘any amount’’ triggering atop level screening process. While DHS wasamenable to comments on the list, the statedposition of the Department was to ‘‘cast asbroad a net as possible’’ and to then sort outthose facilities which would be required todevelop security vulnerability studies andsecurity plans. Many comments were filed withthe DHS on the Appendix A list.1 The ACS fileda strongly worded comment on behalf of themany educational institutions which would becaught up in this process, based on the April 9rule. If your institution is caught in this widenet, what will you be required to do?

DHS defines ‘‘Chemical Facility or facility’’as ‘‘any establishment that possesses or plansto possess, at any relevant point in time, aquantity of a chemical substance determinedby the Secretary to be potentially dangerous orthat meets other risk-related criteria identifiedby the Department. As used herein, the termchemical facility or facility shall also refer tothe owner or operator of the chemical facility.Where multiple owners and/or operators func-tion within a common infrastructure or withina single fenced area, the Assistant Secretarymay determine that such owners and/or opera-tors constitute a single chemical facility ormultiple chemical facilities depending on the

1 Chemical Facility Anti-Terrorism StandardsProposed Appendix A: DHS Chemicals ofInterest, as published on April 9, 2007.2 POCl is entered twice, once with ‘‘anyamount’’ and once with ‘‘2,000 lbs’’ as theScreening Threshold Quantity.

lth and Safety of the American Chemical Society

ed.

circumstances.’’ The only exceptions are speci-fic facilities which are covered by other securityrequirements. Those are those covered by theMaritime Transportation Security Act of 2002,Pub. L. 107-295, as amended; Public WaterSystems, as defined by Section 1401 of the SafeDrinking Water Act, Pub. L. 93-523, asamended; Treatment Works as defined in Sec-tion 212 of the Federal Water Pollution ControlAct, Pub. L. 92-500, as amended; any facilityowned or operated by the Department ofDefense or the Department of Energy, or anyfacility subject to regulation by the NuclearRegulatory Commission. While a campus whichpossesses a NRC license may try to argue that itis exempt, that argument is not supported in therecord. DHS may clarify this later.

The actions required must be accomplishedwithin 60 days of publishing the final AppendixA list in the Federal Register. The list publishedon April 9 is NOT FINAL, thus the complianceclock is not running as of July 5, 2007. Whenthe final list is published, you must take severalactions.

Verify that you do, or do not have chemicalsat your facility in excess of the ScreeningThreshold Quantity. If you do not, place amemo in your files supporting this conclusion.If you do have one or more chemicals in excessof the published trigger quantities, then youmust file a ‘‘Top Screen’’ report using theDHS ‘‘Chemical Security Assessment Tool’’(‘‘CSAT’’).

The CSAT input is used by DHS to assess thelevel of risk (Tier 1 = highest risk; Tier 4 = low-est risk) that your facility poses to homelandsecurity.3 Based on this assessment, you will berequired to do more work, in the form of formalsecurity vulnerability assessments and vulner-ability mitigation plans.

If you must file a Top Screen report, the firststep is to designate a person who is responsible

has determined must provide vulnerability stu-dies and must file security plans. These contactswere made during early July, 2007 and DHS isinstructing those facilities not to publicize theinformation. Unfortunately, security require-ments – real or imagined – place a non-trans-parent veil over much of the activity associatedwith this extremely onerous regulation.

1871-5532/$32.00

doi:10.1016/j.jchas.2007.07.011

for submission of the information andwho attests to its accuracy. This indivi-dual must be an officer of the corpora-tion (or a designee) and must bedomiciled in the United States. Anexamination of the on-line CSAT indi-cated that before this tool can be used tofile information, a complicated securityprocedure must be filed, involving non-electronic and electronic registrationwith confirmation from DHS. At thetime of this writing, it was not possibleto examine the details of the CSATwithout doing a full registration.

The CSAT requires each facility toidentify three different people for thedata submission process. The Prepareris authorized to enter data on-line, butis not authorized to formally submitthe data on behalf of the filing facility.The Submitter is the person certifiedby the filing facility to submit the infor-mation on-line to DHS. The filing facil-ity must also designate a senior officialas the Authorizer who is empoweredto provide written assurance to DHSthat the CSAT account request and thetwo other persons listed is valid. Whilethese three positions can be filled bythe same person, it is clear that accu-racy and security are best served bydesignating three different individuals.

If the DHS determines that yourfacility represents a high risk, thenyou will be notified in writing and willhave 90 calendar days to prepare andsubmit a security vulnerability assess-ment. After review of that assessment,DHS may notify you that you mustprepare and submit a Site SecurityPlan, within 120 calendar days ofreceipt of written notification.

These timelines are very short. Theinterim rule includes substantivepenalties for failure to comply withany element of the rule, including miss-ing mandatory deadlines. Thus, it isincumbent upon impacted facilitiesto begin working now if they believethat DHS will assess them as high risk.

Site Security Plans must addressevery vulnerability issue identified inthe security vulnerability assessment.The DHS expects that the security planwill provide the details of the sitesecurity operation based on the‘‘Restrict, Detect, Deter and Delay’’model. Security plans will be risk-based performance plans. Thus, DHS

Journal of Chemical Health & Safety, Septe

will demand higher levels of perfor-mance for higher risks. This is perhapsmore easily understood by using ahypothetical example.

Consider a typical academic campuswith an electronics research programusing toxic gases. Further, assume thatthe gases have actually been installedusing engineering that complies withthe Toxic Gas Ordinance. The vulner-ability at issue is the theft of the toxicgases and their release in an enclosedarea, such as a public transit system orlarge building.

RESTRICT

The research building will need to haverestricted access, using key-cards with abiometric key. Fingerprint or retinalscanners at the points of access willbe needed. Internal security will beneeded to further restrict access intothe areas where the toxic gases arestored.

DETECT

Video monitors will be needed at eachaccess point. Video monitors andmotion detectors will be needed atthe access point to the toxic gas sto-rage. Finally, the cylinders will need tobe on load cells which alert campussecurity if they are removed withoutauthorization.

DETER

In the event of an unauthorized act, beit a failed entry attempt, unauthorizedentry, or the actual removal of a toxicgas cylinder, engineered systems mustbe activated to deter the successfulremoval of the gases. These systemsmay involve locking of internal doors,activation of audible alarms, and auto-matic requests for security support.

DELAY

The purpose of the security plan is todelay the removal of the toxic gas longenough for security personnel torespond to the location. These person-

mber/October 2007

nel may include campus police and/orlocal police. The facility must have arealistic idea of how long of a delaymust be planned based on the responsetimes for these forces. DHS will expectthat this element has been tested suffi-ciently to support the assumption.

Clearly this level of security willrequire a significant expenditure onthe part of the campus in both engi-neered systems and on-going manage-ment. In order to support theeducational and research mission ofthe campus, student and staff accessto the laboratories must be generallyopen. This means that every person –student or staff – must have a thoroughbackground check before being issueda biometric key to the secure facility.The campus must have a mechanism inplace to update the need for access andrelated security information regularly.On a typical campus, this could requireupdating the information every aca-demic term or more frequently.

One consequence of this interimsecurity rule that is very unclear iswhether campuses will react by elim-inating all chemicals which could trig-ger a Top Screen review. If this was tohappen, significant changes in teach-ing and research will occur. At thispoint it is not possible to predict theimpact of these changes on innovativeoutput of the US academic andresearch community.

The interim rule also requires somerecord keeping. Interestingly, therecord keeping invokes further require-ments which are not completelyexplained in the rule. Records must bekept to reflect training which is requiredat least every three years. The trainingmust also include drills and exercises.Records of all threats, incidents, andsecurity breaches must be kept. Allsecurity equipment maintenance,inspection, and testing logs must beincluded in the recordkeeping. Internaland external audit reports must bedocumented, and of course, copies ofall correspondence with DHS must bemaintained.

This interim rule opens up an entirenew area of expertise for alreadystressed EH&S departments. If youare impacted, your only options willbe to remove the trigger-chemicals orfully comply.

51