United States: Department Of Homeland Security’s New Chemical Facility Anti-Terrorism Standards Are Broadly Applicable To American Industry

The Department of Homeland Security ("DHS") has taken the first step toward establishing a comprehensive regulatory program to ensure the security of facilities storing potentially dangerous chemicals. This program will affect much more than the chemical industry. Many companies throughout American industry will be subject at least to the regulations’ information gathering requirements, and some companies, which own or operate facilities considered by the Government to be "high risk," will be subject to more burdensome security standards. All companies storing potentially dangerous chemicals – including such common substances as propane and ammonium nitrate – need to follow DHS’s regulatory initiative as it unfolds and determine if it applies to them.

In October 2006, Congress directed DHS to promulgate interim final regulations establishing risk-based performance standards for the security of chemical facilities and requiring high risk chemical facilities to conduct vulnerability assessments and implement site security plans. Department of Homeland Security Appropriations Act of 2007, Pub. L. 109-295, § 550. On April 9, 2007, DHS promulgated the interim final rule required by the Act. 72 Fed. Reg. 17,687 (April 9, 2007) (to be codified at 6 C.F.R. Part 27). To a considerable extent, however, the Department’s regulations are a work in progress. DHS currently lacks sufficient information to determine which facilities pose a high level of security risk. Accordingly, DHS has cast a wide net to require facilities storing even small quantities of chemicals to submit screening information for the purposes of DHS’s consequence analysis. The ultimate applicability of the regulations’ potentially burdensome substantive provisions is therefore still unclear. At the same time, even facilities that are not likely to be treated as "high risk" must be aware of their obligations under the regulations’ information gathering provisions.

The new chemical security regulations draw a broad distinction between "chemical facilities" and "covered facilities." "Chemical facilities" include "any establishment that possesses or plans to possess, at any relevant point in time, a quantity of a chemical substance determined by the Secretary to be potentially dangerous or that meets other risk-related criteria identified by the Department." § 27.105. A "covered facility" is a chemical facility "determined by the Assistant Secretary to present high levels of security risk or a facility that the Assistant Secretary has determined is presumptively high risk [following a failure to report under § 27.200]." Id. All chemical facilities are obligated to submit information, in response to either an individualized request from DHS or a Federal Register notice, to determine security risk under § 27.200(a). This must be done by completing and submitting a "Top Screen" on the Department’s secure website. § 27.200(a),(b). A facility must also submit a Top Screen if it possesses any of the chemicals listed in Appendix A of the regulations at the corresponding Screening Threshold Quantities (STQs). § 27.200(b)(2). In essence, DHS does not know enough to determine which facilities pose a high level of security risk and therefore has established a process that will enable it to collect the necessary information to determine the universe of "covered facilities," which do pose a high risk.

Certain facilities are statutorily excluded from any requirements under the Rule, including the obligation to submit screening information. These include:

• facilities regulated under the Maritime Transportation Security Act of 2002, Pub. L. 107-25, as amended;
• Public Water Systems, as defined by Section 1401 of the Safe Drinking Water Act, Pub. L. 93-523, as amended;
• Treatment Works as defined in Section 212 of the Federal Water Pollution Control Act, Pub. L. 92-500, as amended;
• any facility owned or operated by the Department of Defense or the Department of Energy; and

• any facility subject to regulation by the Nuclear Regulatory Commission (NRC).¹

Pub.L. 109-295, § 550(a). DHS incorporated the statutory exclusions in its rule and rejected requests made by commenters for additional exclusions. § 27.110(b); 72 Fed. Reg. at 17,699. In response to public comments, DHS clarified that it does not intend at present to request that railroad facilities or long-haul pipelines complete or submit a Top Screen but is continuing to study the issue and may address it in a subsequent rulemaking. Id. The Department does, however, expect mining companies to complete and submit a Top Screen in accordance with § 27.200(b). Id.²

Although the new chemical facility security regulations were effective on June 8, 2007, the obligation to submit Top-Screen information will not be effective until DHS finalizes a list of "Chemicals of Interest" along with corresponding STQs, which will appear in Appendix A to the regulations. (The proposed list is published at 72 Fed. Reg. at 17,739-17,745.) DHS developed the proposed list of Chemicals of Interest by drawing from existing sources of information, such as the U.S. Environmental Protection Agency’s ("EPA") Risk Management Program and the Chemical Weapons Convention. It focused on three main security issues:

1. "Release" – i.e., whether certain quantities of toxic, flammable or explosive chemicals, if released from the facility, have the potential for significant adverse consequences for human life or health;
2. "Theft or Diversion" – i.e., whether certain chemicals or materials, if stolen or diverted, have the potential to be used as weapons or to be easily converted into weapons using simple chemistry, equipment or techniques; and
3. "Sabotage or Contamination" – i.e., whether certain chemicals or materials, if mixed with readily-available materials, have the potential to create significant adverse consequences for human life or health.³

72 Fed. Reg. at 17,696. The proposed list of Chemicals of Interest consists of more than 340 chemicals, including propane, ammonium nitrate and anhydrous ammonia.

The STQs are not threshold quantities that establish whether a given facility is high risk and therefore subject to the regulations’ security performance standards. Id. at 17,695. Rather, they only set the preliminary threshold that requires a facility to complete a Top-Screen questionnaire. Many of the Chemicals of Interest have proposed STQs of "any amount," but the quantities range up to 15,000 lbs (e.g., the STQ for propane is 7,500 lbs, for ammonium nitrate 2,000, and for anhydrous ammonia 7,500 lbs).

As noted above, the effective date for Appendix A, which has not yet been established, starts the clock for Top-Screen submissions. After the effective date of the final Appendix A, if a facility manufactures, uses, stores or distributes a Chemical of Interest in a quantity exceeding the STQ, the facility must submit the Top Screen within 60 calendar days. If a facility comes into possession of any such chemical at the corresponding STQ after the effective date of the final Appendix A, the facility must submit the Top Screen within 60 calendar days of coming into possession of the chemical. § 27.210(a)(1)(i).

The information that DHS collects through the Top Screen is one of several factors that DHS will consider in determining whether a facility is "high-risk" and therefore a "covered facility" subject to the security performance standards of the Rule. 72 Fed. Reg. at 17,690. DHS considers a facility to be high risk if it "presents a high risk of significant adverse consequences for human life or health, national security and/or critical economic assets if subjected to terrorist attack, compromise, infiltration, or exploitation." § 27.105. DHS has not, however, described in detail how it will determine whether a facility presents a high level of security risk. Rather, the Rule says that "[o]nly after [DHS] gathers additional information through the Top-Screen process will [DHS] make a determination as to whether a facility presents a high risk …. the Department has the authority to use its best judgment and all available information in determining whether a facility presents a high-level of security risk." 72 Fed. Reg. at 17,696. There is no way to know at this time if a facility will be subject to the substantive security standards in the Rule. DHS says that it "anticipates that the vast majority of screened facilities will be found not to have a level of potential consequences that result in a high risk designation" but that the facilities that are determined to be high risk are expected to come from a "broad swath" of the nation’s economy. Id. at 17,770.

A facility that is determined by DHS to be "high risk" may seek a redetermination by DHS if it materially alters its operations in a relevant manner. § 27.205(b). A facility may also request a consultation with DHS to determine if any modifications to the facility, processes, or types or quantities of materials possessed at the facility affect whether it is subject to the regulations or the nature of its obligations under them. § 27.120(d). However, in either case, requesting a consultation with DHS does not toll any of the applicable timelines in the Rule. 72 Fed. Reg. at 17,690.

Once a facility is notified by DHS that it is considered to be "high risk," the facility must complete the Security Vulnerability Assessment (SVA) within 90 days of written notice by DHS, and must complete the Site Security Plan (SSP) within 120 days of such written notice. §27.210. The SVA must include (i) a description of the facility’s critical assets and existing layers of protection; (ii) an assessment of both internal and external threats; (iii) identification of potential security vulnerabilities; (iv) a risk assessment of the potential effects on critical assets and the likelihood of success of an attack; and (v) an analysis of countermeasure strategies. § 27.215.

DHS will use information submitted in the Top-Screen process to place each covered facility in one of four risk-based tiers. The tiers, ranked one (highest risk) through four (lowest risk) dictate the security measures necessary to meet the performance standards for the particular facility. For facilities in the higher risk tiers, the security measures necessary to meet the performance standards will be more robust to provide for greater protection. 72 Fed. Reg. at 17,692. A facility’s final tier ranking is based upon the complete SVA submitted by the facility, and DHS’s application of threat information. Id. at 17732.

The facility’s SSP must address the vulnerabilities identified in the SVA, describe how the selected security measures will address the applicable risk-based performance standards and potential modes of terrorist attack, and identify and describe how security measures used by the facility will meet or exceed the applicable performance standards for the appropriate risk based tier. § 27.225. The Rule lists 19 performance standards that address, among other things:

• securing the facility’s perimeter;
• securing site assets;
• screening and controlling access to the facility;
• deterring, detecting and delaying an attack to allow successful use of countermeasures;
• securing and monitoring the shipment, receipt and storage of hazardous chemicals for the facility;
• deterring theft and diversion of potentially dangerous chemicals;
• deterring cyber sabotage;
• training;
• performing background checks on facility personnel and unescorted visitors;⁴ and
• reporting significant security incidents to DHS and local law enforcement officials and maintaining appropriate records. §27.230.

DHS intends to publish additional guidance on the application of these standards to each risk tier, including "acceptable layering of measures" to meet these standards.

DHS will review SSPs proposed for the facility and make a preliminary determination regarding compliance with the performance standards. § 27.245(a). DHS will then conduct a facility inspection to confirm compliance. Id. In the event that DHS disapproves a SSP, the facility must consult with DHS to ensure compliance. § 27.245(b). Under the Act, DHS may not disapprove an SSP based on the presence or absence of a particular security measure. Rather, an SSP may only be disapproved if it fails to satisfy the risk-based performance standards.

The Rule establishes periodic resubmission deadlines for covered facilities. Basically, Tier 1 and 2 facilities must submit a revised Top Screen, SVA and SSP after two years, while Tier 3 and 4 facilities must do so after three years.⁵ In addition, if a facility makes material modifications to its operations or site, it must submit a revised Top Screen within 60 calendar days § 27.210(d). DHS will then notify the facility if a new SVA or SSP is required. Id.

The owners or operators of many chemical facilities have already expended significant resources and expense to identify and address facility security vulnerabilities. As a result, DHS allows certain facilities to submit an Alternative Security Program ("ASP"), which is a third-party, industry, or local, state or federal security program, if DHS finds that the ASP "provides an equivalent level of security." § 27.235(a). For facilities in Tiers 1 though 3, the ASP may substitute for the SSP otherwise required under the regulations, but it may not substitute for the required SVA. Tier 4 facilities, however, may submit an ASP in lieu of a SVA, SSP or both. Id.

The Act grants DHS the exclusive authority to conduct audits and inspections and otherwise enforce the chemical security regulations. There is no provision, therefore, for a citizen enforcement suit. The Act also authorizes DHS to order a facility to cease operations if, after being notified and provided with an opportunity for consultation with DHS, the facility fails to comply with the Rule. The Rule authorizes civil penalties of up to $25,000 for each day a violation continues and provides procedures for appeals of DHS determinations and orders. See § 27.300(b)(3), and Part 27, Subpart C. In any enforcement action, SVAs, SSPs and other information gathered by the Department under the program must be treated as classified information. Act § 550(c); 6 C.F.R. § 27.400(i).

The Act expressly provides that "[n]othing in this section shall be construed to supersede, amend, alter or affect any Federal law that regulates the manufacture, distribution in commerce, use, sale, other treatment, or disposal of chemical substances or mixtures." § 500(f); see also 6 C.F.R. § 27.405(a)(1).

The Act does not expressly address the preemptive effect of the Department’s chemical security regulations on state or local law. The regulations provide, however, that a state

or local program will only be preempted by the regulations if it "conflicts with, hinders, poses an obstacle to or frustrates the purposes of the [regulations]." § 27.405(a). Facilities may petition DHS to issue an opinion on whether particular state or local laws are preempted. § 27.405(c). As noted below, the regulations’ preemption of stricter security requirements in state or local laws is controversial and may shortly be overturned legislatively.

All information and records gathered under the Rule constitute Chemical-terrorism Vulnerability Information ("CVI") and are protected from public disclosure. The Rule specifies procedures for protecting against unauthorized public disclosure and notification procedures when such disclosure has occurred. § 27.400.

Section 550 of the 2007 DHS Appropriations Act was an effort to jump-start regulation of the security of chemical facilities, and Congress provided for early sunset of the Act (in just 3 years), presumably in order to revisit the issue in a more considered way in the future.⁶ Among the issues that prevented a more comprehensive bill in 2006 was a controversy regarding forcing inherently safer technologies to reduce the risk of security breaches. Moreover, perhaps predictably, DHS’s regulations have proven controversial. Among significant concerns are the exclusion of maritime and wastewater facilities from the program, the breadth of the preemption provision and protection of sensitive security information in the event of litigation.

Both houses of Congress have included language in this year’s DHS appropriations bills that would amend § 550.⁷ The two houses agree that the DHS regulations go too far in the direction of preempting stricter state and local regulatory schemes, and the House bill zeros in on protection of sensitive security information as well. The final appropriations bill will probably contain at least some language amending the Act, although such language faces a veto threat. Such an amendment would not, however, prevent Congress from revisiting the program in a more comprehensive way at a later date.

The owner or operator of any facility that stores chemicals should consult the list of Chemicals of Concern and associated STQs in Appendix A of the regulations to determine if it is required to complete a Top Screen. The Top Screen must be submitted within 60 days of the effective date of Appendix A or within 60 days of coming into possession of the chemicals after Appendix A is finalized. The owner or operator of a facility that is determined by DHS to be a high-risk, "covered" facility must be familiar with the procedures and substantive security performance standards of the Rule and must have sufficient technical and legal expertise to ensure compliance with the Rule’s complex requirements.

Goodwin Procter LLP is one of the nation’s leading law firms, with a team of 700 attorneys and offices in Boston, Los Angeles, New York, San Diego, San Francisco and Washington, D.C. The firm combines in-depth legal knowledge with practical business experience to deliver innovative solutions to complex legal problems. We provide litigation, corporate law and real estate services to clients ranging from start-up companies to Fortune 500 multinationals, with a focus on matters involving private equity, technology companies, real estate capital markets, financial services, intellectual property and products liability.

This article, which may be considered advertising under the ethical rules of certain jurisdictions, is provided with the understanding that it does not constitute the rendering of legal advice or other professional advice by Goodwin Procter LLP or its attorneys. © 2007 Goodwin Procter LLP. All rights reserved.