CFATS bill passes the House; now would be a good time to get up to speed

WASHINGTON—A bill that would allow the Department of Homeland Security to impose new security regulations on facilities that house possibly dangerous chemicals, along with a related bill that addresses security at water and wastewater treatment facilities, took an important step forward on Nov. 9, when the House of Representatives for the first time passed the Chemical Facility Anti-Terrorism Act of 2009 and the Drinking Water System Security Act of 2009.

Now the Senate must take up the bill and both houses will likely have to vote again on a compromise bill. But what's all the fuss about?

Both bills are aimed at improving security at these high-risk facilities, but have left a lot of questions unanswered as far as what further security measures may be required, said Brent Franklin, president of Unlimited Technology, a system integrator with several chemical facility clients.

“There is not a definitive parameter about what they'll have to do in the form of risk-based measures and securing the facility and perimeter,” said Franklin. “These chemical customers have conformed to what is out there, but there's no written standards about what they'll have to do.”

All “Tier 1” facilities were previously required to submit extensive security plans, which DHS estimated would take about 200 man-hours to complete. Now, those chemical facilities are “sitting with baited breath and nobody has a really clear understanding about what to expect back from DHS,” Franklin said.

Dan Weiss, recently hired to head up Siemens' CFATS efforts, agreed with Franklin, but said many end users are moving forward despite the uncertainty. “They're aware that when you look at risk-based performance standards, it's going to be at least sound security practices, clear perimeters, clear camera lines, I'm seeing some expenditures occur because they know that at least—well, they're not going to look at a plant that makes chlorine and not want a decent perimeter, there's no way that's going to happen. They're already trying to get ahead of the curve.”

A significant part of the issue is the restrictions placed on DHS, said Patrick Coyle, a former chemical facility employee and author of Chemical Facility Security News blog. “DHS could not specifically require any specific type of security arrangement, so instead they had to establish performance standards rather than tell people how to do security,” Coyle said. “In general, that's a good way to approach it, but it caused a lot of problems because DHS can't tell people what to do and some companies don't have the foggiest idea about security and want to be told how to secure their facility.”

Coyle said that problems complying with potential regulations will differ based on the size of a company. “Big players like Exxon and Dupont, they have pretty good security, it's not perfect, but it's good enough to keep terrorists out of their facility. The midlevel companies—that's where the proposition is dicier,” he said.

And that's where security integrators can lend their services, said Weiss, who before coming to Siemens had focused on the regulated security market as CEO of Infrastruct, based in Houston.

“I think they'll end up getting very specific,” he said of the eventual CFATS security regulations, “and I think what you're looking for as an integrator is a relationship with the local enforcement agents, just like with the fire alarm industry, and the NFPA standards and how they're interpreted. Basically the DHS is hiring enforcement officers ... and the way they're talking about it now is a decentralized view, where the local officers work with local jurisdictions to determine what the best total solution is.” Again, it's similar to the way that AHJs are the drivers behind fire regulations. “The local fire chief, your local code enforcer has a lot of power,” Weiss said, “and I don't think the DHS guys will have less power; they'll have more power. Most code guys can't levy the fines these [CFATS] guys can. These guys can shut down facilities and levy million dollar fines per day. The scale is a lot different.”

Who will these local enforcement officers be? “I think a lot of them are coming back from Iraq and Afghanistan and they've done site security for military applications,” Weiss said. “They look for people who maybe were Coast Guard and port people, people who have dealt with the new maritime laws that came after 9/11. I hope that common sense finds some common ground. If I was an end user I might be concerned about it, but most of the people I've met know that these facilities need to function, and the goal is not to shut them down.”

Similarly, imposing new security regulations and standards on drinking water and wastewater facilities also poses significant concerns. The bill that had just passed the House when Security Systems News went to press would remove the CFATS exemption status from such facilities. Will the water supply be interrupted?

“They're going to put water and wastewater treatment facilities under CFATS because of chemicals used to treat water,” said Franklin from Unlimited Technology. 

However, both water and chemical companies will have to wait for Congress to decide how to regulate and standardize security measures in such facilities. It is estimated that the final versions of these bills will not reach the House and Senate floors for final votes until the beginning of next year.

However, said Weiss, if end users are quaking in their boots at the prospect of the final regulations being too harsh, in some ways they have only themselves to blame.

“I'm sure people were real nervous about the creation of the NFPA, too,” he said, “and everybody was saying, 'No one will have bars with more than 30 people in them! Oh, no!' But that didn't come to pass. There is an appropriate place for government regulation. The private sector had a long time to address this on their own, and they didn't do it very well, so the government has taken an appropriate place to step in when the potential loss is tremendous. I think they'll do a good job. I haven't had one time where it's been like, 'We'll show these guys!' The people doing the enforcement have real experience and they've been on the front lines. I wouldn't be particularly worried about it.”