    [House Hearing, 115 Congress]
    [From the U.S. Government Publishing Office]

      THE CHEMICAL FACILITIES ANTI-TERRORISM STANDARDS PROGRAM (CFATS)_A
                                PROGRESS REPORT

    =======================================================================

                                    HEARING

                                   BEFORE THE

                          SUBCOMMITTEE ON ENVIRONMENT

                                     OF THE

                        COMMITTEE ON ENERGY AND COMMERCE
                            HOUSE OF REPRESENTATIVES

                         ONE HUNDRED FIFTEENTH CONGRESS

                                 SECOND SESSION

                                   __________

                                 JUNE 14, 2018

                                   __________

                               Serial No. 115-138

    [GRAPHIC NOT AVAILABLE IN TIFF FORMAT]

          Printed for the use of the Committee on Energy and Commerce

                            energycommerce.house.gov

                                   __________

                        U.S. GOVERNMENT PUBLISHING OFFICE
    34-591                      WASHINGTON : 2019

    -----------------------------------------------------------------------------------
    For sale by the Superintendent of Documents, U.S. Government Publishing Office,
    http://bookstore.gpo.gov. For more information, contact the GPO Customer Contact Center,
    U.S. Government Publishing Office. Phone 202-512-1800, or 866-512-1800 (toll-free).E-mail,
    gpo@custhelp.com.

                        COMMITTEE ON ENERGY AND COMMERCE

                              GREG WALDEN, Oregon
                                     Chairman
    JOE BARTON, Texas                    FRANK PALLONE, Jr., New Jersey
      Vice Chairman                        Ranking Member
    FRED UPTON, Michigan                 BOBBY L. RUSH, Illinois
    JOHN SHIMKUS, Illinois               ANNA G. ESHOO, California
    MICHAEL C. BURGESS, Texas            ELIOT L. ENGEL, New York
    MARSHA BLACKBURN, Tennessee          GENE GREEN, Texas
    STEVE SCALISE, Louisiana             DIANA DeGETTE, Colorado
    ROBERT E. LATTA, Ohio                MICHAEL F. DOYLE, Pennsylvania
    CATHY McMORRIS RODGERS, Washington   JANICE D. SCHAKOWSKY, Illinois
    GREGG HARPER, Mississippi            G.K. BUTTERFIELD, North Carolina
    LEONARD LANCE, New Jersey            DORIS O. MATSUI, California
    BRETT GUTHRIE, Kentucky              KATHY CASTOR, Florida
    PETE OLSON, Texas                    JOHN P. SARBANES, Maryland
    DAVID B. McKINLEY, West Virginia     JERRY McNERNEY, California
    ADAM KINZINGER, Illinois             PETER WELCH, Vermont
    H. MORGAN GRIFFITH, Virginia         BEN RAY LUJAN, New Mexico
    GUS M. BILIRAKIS, Florida            PAUL TONKO, New York
    BILL JOHNSON, Ohio                   YVETTE D. CLARKE, New York
    BILLY LONG, Missouri                 DAVID LOEBSACK, Iowa
    LARRY BUCSHON, Indiana               KURT SCHRADER, Oregon
    BILL FLORES, Texas                   JOSEPH P. KENNEDY, III,
    SUSAN W. BROOKS, Indiana                 Massachusetts
    MARKWAYNE MULLIN, Oklahoma           TONY CARDENAS, CaliforniaL RUIZ,
    RICHARD HUDSON, North Carolina           California
    CHRIS COLLINS, New York              SCOTT H. PETERS, California
    KEVIN CRAMER, North Dakota           DEBBIE DINGELL, Michigan
    TIM WALBERG, Michigan
    MIMI WALTERS, California
    RYAN A. COSTELLO, Pennsylvania
    EARL L. ``BUDDY'' CARTER, Georgia
    JEFF DUNCAN, South Carolina

                          Subcommittee on Environment

                             JOHN SHIMKUS, Illinois
                                     Chairman
    DAVID B. McKINLEY, West Virginia     PAUL TONKO, New York
      Vice Chairman                        Ranking Member
    JOE BARTON, Texas                    RAUL RUIZ, California
    TIM MURPHY, Pennsylvania             SCOTT H. PETERS, California
    MARSHA BLACKBURN, Tennessee          GENE GREEN, Texas
    GREGG HARPER, Mississippi            DIANA DeGETTE, Colorado
    PETE OLSON, Texas                    JERRY McNERNEY, California
    BILL JOHNSON, Ohio                   TONY CARDENAS, California
    BILL FLORES, Texas                   DEBBIE DINGELL, Michigan
    RICHARD HUDSON, North Carolina       DORIS O. MATSUI, California
    KEVIN CRAMER, North Dakota           FRANK PALLONE, Jr., New Jersey (ex
    TIM WALBERG, Michigan                    officio)
    EARL L. ``BUDDY'' CARTER, Georgia
    JEFF DUNCAN, South Carolina
    GREG WALDEN, Oregon (ex officio)

                                 C O N T E N T S

                                  ----------
                                                                       Page
    Hon. John Shimkus, a Representative in Congress from the State of
      Illinois, opening statement....................................     1
        Prepared statement...........................................     3
    Hon. Paul Tonko, a Representative in Congress from the State of
      New York, opening statement....................................     4
    Hon. Frank Pallone, Jr., a Representative in Congress from the
      State of New Jersey, opening statement.........................     5
    Hon. Greg Walden, a Representative in Congress from the State of
      Oregon prepared statement......................................     7

                                   Witnesses

    Dave Wulf, Acting Deputy Assistant Secretary, Infrastructure
      Protection, U.S. Department of Homeland Security...............     8
        Prepared statement...........................................    11
        Answers to submitted questions...............................   121
    Chris P. Currie, Director, Emergency Management, National
      Preparedness, and Critical Infrastructure Protection, Homeland
      Security and Justice Team, U.S. Government Accountability
      Office.........................................................    50
        Prepared statement...........................................    52
        Answers to submitted questions...............................   137
    Doug Brown, President and COO, Brown Chemical Company............    68
        Prepared statement...........................................    70
        Answers to submitted questions...............................   146
    Mike Wilson, National Director, Occupational And Environmental
      Health, Bluegreen Alliance.....................................    75
        Prepared statement...........................................    77
        Answers to submitted questions...............................   152
    Steve Roberts, Principal, Chemical Security Group, LLC...........    88
        Prepared statement...........................................    90
        Answers to submitted questions...............................   178
    James Conrad, Principal, Conrad Law and Policy Counsel, on Behalf
      of Society of Chemical Manufacturers and Affiliates............   100
        Prepared statement...........................................   102
        Answers to submitted questions...............................   187
    Vette Arellano, Policy Research and Grassroots Advocate, Texas
      Environmental Justice Advocacy Services........................   107
        Prepared statement...........................................   110

                               Submitted Material

    Statement of the Chemical Facility Anti-Terrorism Standards
      Coalition......................................................   119

      THE CHEMICAL FACILITIES ANTI-TERRORISM STANDARDS PROGRAM (CFATS)--A
                                PROGRESS REPORT

                                  ----------

                            THURSDAY, JUNE 14, 2018

                      House of Representatives,
                           Subcommittee on Environment,
                               Committee on Energy and Commerce
                                                        Washington, DC.
        The subcommittee met, pursuant to call, at 10:00 a.m., in
    room 2123 Rayburn House Office Building, Hon. John Shimkus
    (chairman of the subcommittee) presiding.
        Members present: Representatives Shimkus, McKinley, Harper,
    Olson, Johnson, Flores, Walberg, Carter, Duncan, Walden (ex
    officio), Tonko, Ruiz, Peters, Green, DeGette, McNerney,
    Cardenas, Dingell, Matsui, and Pallone (ex officio).
        Staff present: Mike Bloomquist, Deputy Staff Director;
    Samantha Bopp, Staff Assistant; Kelly Collins, Staff Assistant;
    Jerry Couri, Chief Environmental Advisor; Margaret Tucker
    Fogarty, Staff Assistant; Jordan Haverly, Policy Coordinator,
    Environment; Mary Martin, Deputy Chief Counsel, Energy &
    Environment; Sarah Matthews, Press Secretary; Drew McDowell,
    Executive Assistant; Peter Spencer, Professional Staff Member,
    Energy; Austin Stonebraker, Press Assistant; Hamlin Wade,
    Special Advisor, External Affairs; Everett Winnick, Director of
    Information Technology; Jean Fruci, Minority Energy and
    Environment Policy Advisor; Caitlin Haberman, Minority
    Professional Staff Member; Rick Kessler, Minority Senior
    Advisor and Staff Director, Energy and Environment; Jourdan
    Lewis, Minority Staff Assistant; Alexander Ratner, Minority
    Policy Analyst; Tuley Wright, Minority Energy and Environment
    Policy Advisor; C.J. Young, Minority Press Secretary; and
    Catherine Zander, Minority Environment Fellow.

      OPENING STATEMENT OF HON. JOHN SHIMKUS, A REPRESENTATIVE IN
                  CONGRESS FROM THE STATE OF ILLINOIS

        Mr. Shimkus. The subcommittee will now come to order. The
    chair recognizes himself for 5 minutes for the purpose of an
    opening statement.
        Today, the subcommittee will check on the progress of the
    Chemical Facilities Anti-Terrorism Standards Program, or CFATS,
    allowing our subcommittee to review the progress of the CFATS
    program, including overall implementation by the Department of
    Homeland Security as well as overall achievement of benchmark
    objectives identified in the past by the Government
    Accountability Office.
        This program, which Congress authorized in the fall of 2006
    was a continuation of congressional efforts since the terror
    attacks of September 11, 2001, to surgically and directly
    address gaps in Federal law regarding terrorism or other
    intentional acts against high-risk facilities due to their use
    or possession of chemicals of concern at levels of concern. The
    core of this new security-focused law was a process where DHS
    issued risk-based performance standards that required
    vulnerability assessments and the site security plans by
    covered facilities. Most importantly, to avoid overlapping with
    other Federal programs, CFATS was designed to foster
    collaboration between government and regulated parties. Having
    finally set up this program, many had great optimism about its
    possibilities. Unfortunately, the early years of CFATS program
    implementation were marked with several growing pains, some
    more hurtful than others. No one knows that more that our
    witness from the Department of Homeland Security, David Wulf.
    Very few people have demonstrated the courage, commitment, and
    longevity with the program that he has. He's kind of the Cal
    Ripken of CFATS.
        Based on this subcommittee's hearing in March 2014, we know
    Mr. Wulf not only set many remedial goals to address issues he
    found in the CFATS program, but GAO also found areas that
    needed serious attention. GAO provided recommendations to DHS
    on how to correct these areas. I look forward to hearing about
    the progress DHS is making here from Mr. Wulf on the first
    panel, and from Christopher Currie at GAO, who is on the second
    panel.
        I also look forward to a meaningful dialogue with our other
    witnesses representing CFATS regulated stakeholders as well as
    those of organized labor, environmental, and community advocacy
    interests.
        Particularly, I am interested in knowing what steps DHS has
    taken to improve its risk assessment methodology and what that
    has meant for facility tiering, what DHS has done to become
    more effective and efficient carrying out the CFATS program,
    and, finally, what steps has DHS taken to improve CFATS program
    transparency and communication with regulated facilities,
    whether it relates to the facility tiering or employee
    screening. In my opinion, CFATS has had four uninterrupted
    years to course correct and these are threshold questions that
    must be addressed in evaluating whether CFATS is a worthwhile
    investment for the United States taxpayer.
        I know there are some who would like to see the CFATS
    universe expand to also do EPA's job, or OSHA's job, or FEMA's
    job, or addressed some other way and we have had lively
    discussions on the advisability of these changes in the past.
    My own thinking has been guided by two thoughts. Are these new
    requirements advisable as a legally enforceable part of this
    program, filling a security gap that does not exist or are they
    merely an additive burden without security benefits, and
    recognizing the challenges CFATS has faced in the past, CFATS
    must excel at its present obligations before being given new
    responsibilities.
        I want to thank our witnesses for being with us today. We
    look forward to having your experience, wisdom, and ideas.
        [The prepared statement of Mr. Shimkus follows:]

                    Prepared statement of Hon. John Shimkus

        The Subcommittee will now come to order; and the Chair
    recognizes himself for 5 minutes for the purposes of an opening
    statement.
        Today, the Subcommittee will check in on the progress of
    the Chemical Facilities Anti-Terrorism Standards Program or
    CFATS, allowing our Subcommittee to review the progress of the
    CFATS program, including program implementation by the
    Department of Homeland Security (DHS) as well as overall
    achievement of benchmark objectives identified in the past by
    the Government Accountability Office (GAO).
        This program, which Congress authorized in the fall 2006,
    was a continuation of congressional efforts since the terror
    attacks of September 11, 2001, to surgically and directly
    address gaps in Federal law regarding terrorism or other
    intentional acts against high-risk facilities due to their use
    or possession of chemicals of concern at levels of concern. The
    core of this new security-focused law was a process where DHS
    issued risk-based performance standards that required
    vulnerability assessments and site security plans by covered
    facilities. Most importantly, to avoid overlapping with other
    Federal programs, CFATS was designed to foster collaboration
    between the government and regulated parties. Having finally
    set up this program, many had great optimism about its
    possibilities. Unfortunately, the early years of CFATS program
    implementation were marked with several growing pains, some
    more hurtful than others. No one knows that more that our
    witness from the Department of Homeland Security, David Wulf.
    Very few people have demonstrated the courage, commitment, and
    longevity with the program that he has--he's kind of the Cal
    Ripken of CFATS.
        Based on this Subcommittee's hearing in March of 2014, we
    know Mr. Wulf not only set many remedial goals to address
    issues he found in the CFATS program, but GAO also found areas
    that needed serious attention. GAO provided recommendations to
    DHS on how to correct these areas. I look forward to hearing
    about the progress DHS is making here from Mr. Wulf on our
    first panel, and from Christopher Currie at GAO, who is on the
    second panel.
        I also look forward to a meaningful dialogue with our other
    witnesses representing CFATS regulated stakeholders as well as
    those of organized labor, environmental, and community advocacy
    interests.
        Particularly, I am interested in knowing what steps DHS has
    taken to improve its risk assessment methodology and what that
    has meant for facility tiering, what DHS has done to become
    more effective and efficient carrying out the CFATS program,
    and, finally, what steps has DHS taken to improve CFATS program
    transparency and communication with regulated facilities--
    whether it relates to facility tiering or employee screening.
    In my opinion, CFATS has had four uninterrupted years to course
    correct and these are threshold questions that must be
    addressed in evaluating whether CFATS is a worthwhile
    investment for the United States taxpayer.
        I know there are some who would like to see the CFATS
    universe expanded to also do EPA's job, or OSHA's job, or
    FEMA's job, or addressed some other way--and we have had lively
    discussions on the advisability of these changes in the past.
    My own thinking has been guided by two thoughts: (1) are these
    new requirements advisable as a legally enforceable part of
    this program, filling a security gap that does not exist, or
    are they merely an additive burden without security benefits,
    and (2) recognizing the challenges CFATS has faced in the past,
    CFATS must excel at its present obligations before being given
    new responsibilities.
        I want to thank our witnesses for being with us today. We
    look forward to having your experience, wisdom, and ideas.
        With that, I yield back the balance of my time.

        Mr. Shimkus. With that, I have a minute left. Anyone
    seeking time? No one is seeking time so I will yield back and
    recognize the ranking member of the subcommittee, Mr. Tonko
    from New York, for 5 minutes.

       OPENING STATEMENT OF HON. PAUL TONKO, A REPRESENTATIVE IN
                  CONGRESS FROM THE STATE OF NEW YORK

        Mr. Tonko. Thank you, Mr. Chair, and thank you to our
    witnesses for your testimony, the Department of Homeland
    Security's Chemical Facility Anti-Terrorism Standards, or CFATS
    program.
        CFATS is an important part of our nation's counterterrorism
    efforts to secure high-risk chemical facilities. The program
    was first created in late 2006 through a DHS appropriations
    bill. In the early years, Congress extended the program through
    annual appropriations under the passage of a long-term
    authorization in 2014. Without further congressional action the
    program will terminate in January of 2019.
        Under CFATS certain chemical manufacturing, handling, and
    storage facilities must implement risk-based performance
    standards for vulnerability assessments and site security
    plans. Facilities that possess certain chemicals of interest
    must be screened by DHS. If a facility is deemed a high risk,
    it will be placed in one of four tiers that will establish
    standards appropriate to secure the site. As of May 30th of
    2018 the CFATS program identifies 3,395 facilities as high risk
    with 159 in tier one and 78 in tier two.
        While there is complete agreement around the need for a
    program to keep these chemicals out of the hands of terrorists,
    even the program's most ardent supporters would admit there
    have been implementation problems.
        Over the years, DHS has addressed a number of concerns with
    the program including some of GAO's recommendations which we
    will hear about today, I am certain.
        As Congress considers reauthorization, this is an
    opportunity to review the program and consider what is working,
    working well, and how the program could be improved. This
    includes how we might continue to reduce risks at these sites
    and ensure that workers, first responders, and local
    communities have the information they need to stay safe.
        In my view, we should be working to reauthorize CFATS and,
    hopefully, improving it. But I would caution against a
    permanent reauthorization. It is rare for us to discuss this
    program and a permanent reauthorization may result in even less
    congressional oversight.
        We should also keep in mind that CFATS is not the only
    Federal program to regulate chemical facilities. While others
    are beyond the scope of DHS, I strongly believe Congress should
    be looking at all aspects of risks at chemical facilities, not
    just terrorism.
        Recent incidents should remind us that our concerns must
    not be limited to security issues alone. We should take a
    holistic approach to chemical risks which, obviously, includes
    facility security as well as safety, accounting for the risks
    to the people working there and living in nearby communities
    and facilities' resilience.
        Chemical fires, explosions, and releases can have serious
    consequences regardless of whether an incident was an accident,
    a natural disaster or an act of terrorism. For example, EPA's
    risk management plan program is focused on reducing chemical
    risk in the event of an accidental release. RMP establishes
    emergency measures which help local first responders prepare
    for and respond to a chemical accident.
        In January of 2017, the Obama administration finalized an
    RMP amendments rule but in June of last year EPA delayed that
    rule's implementation, and a few weeks ago EPA proposed a
    reconsideration of the RMP program, which would essentially
    roll back nearly all of the safety measures that were adopted
    in 2017.
        In addition to safety issues, chemical facilities are also
    vulnerable to climate change and natural disasters as we have
    seen during Hurricane Harvey when a power outage and equipment
    failure led to a significant chemical fire at the Arkema
    facility in Crosby, Texas. The Chemical Safety Board's post-
    Arkema report recommended the development of comprehensive
    industry guidance to help companies assess their risk for
    potential extreme weather events.
        While we all support keeping these facilities secure, I
    hope we can also address these critical safety and resilience
    issues, and if there is an opportunity to improve CFATS in a
    way that close security gaps, reduce risks, better address
    emerging threats such as cybersecurity and keep first
    responders and workers safer, now is an excellent opportunity
    to consider those changes to the program.
        Again, I thank the chair for calling this hearing and thank
    our witnesses for being here today, and I yield back, Mr.
    Chair.
        Mr. Johnson [presiding]. I thank the gentleman for yielding
    back.
        The chair now recognizes the ranking member of the full
    committee, Mr. Pallone, for 5 minutes.

    OPENING STATEMENT OF HON. FRANK PALLONE, JR., A REPRESENTATIVE
                IN CONGRESS FROM THE STATE OF NEW JERSEY

        Mr. Pallone. Thank you, Mr. Chairman.
        It's been over 5 years since this committee held a hearing
    on the Department of Homeland Security's Chemical Facility
    Anti-Terrorism Standards, or CFATS. Given CFATS' inauspicious
    history, I believe we should have conducted more regular
    oversight. Existing CFATS authorization expires on January 2019
    so it's important that Congress act to continue this program.
        At the same time, there are well-documented gaps in the
    current statute that Congress should address instead of simply
    rubber stamping an extension of the existing program.
        I've been an advocate for increased safety and security at
    our nation's chemical facilities for many years, well before
    the CFATS program was established in 2006.
        My home State of New Jersey, which has a high population
    density, also has a large number of chemical facilities. So the
    consequences of insufficient security are dire.
        The program shouldn't have any gaps, and while it took the
    program five years to approve its first chemical facility
    security plan, I understand we will hear today that
    improvements have been made.
        Nevertheless, there are still shortfalls in the program
    that DHS cannot address without changes to the law. For
    example, several significant categories of facilities are
    exempt from the standards, such as public water systems and
    wastewater treatment plants, and they should be added.
        We should also reject a suggestion from Senate Republicans
    that we exempt explosive manufacturers from this anti-terrorism
    program.
        We also cannot have a conversation about chemical
    facilities without discussing the Trump administration's
    reckless proposal to dismantle EPA's risk management program,
    or RMP, improvement rule.
        This is a common sense update to a nearly 20-year-old risk
    planning and reduction policy for our nation's chemical
    facilities. The rule would have improved chemical process
    safety, assisted local emergency authorities and planning for
    and responding to accidents and improved public awareness of
    chemical hazards at regulated facilities.
        Unfortunately, the administration's decision to walk away
    from the RMP improvement rule has widespread and harmful
    ramifications. Dangerous incidents at chemical facilities
    across the country are happening too often. Forty-six incidents
    have occurred at RMP facilities since Administrator Pruitt
    blocked the RMP improvement rule. Had the rule been in place,
    those facilities would have been required to prepare for and
    implement safety improvements to reduce the frequency and
    severity of those events. The highest profile case occurred in
    the aftermath of Hurricane Harvey at the Arkema chemical plant
    in Crosby, Texas. Heavy rains flooded the facility, causing
    equipment to fail, triggering a chemical fire, and releasing
    hazardous fumes and smoke into the air.
        Last month, the Chemical Safety Court released an
    investigative report on the incident and found that chemical
    facilities are wholly unprepared for extreme weather events
    like floods and hurricanes. Improving the resiliency of these
    facilities will only become more critical as the climate
    continues to change. More frequent flooding and powerful storms
    associated with unchecked climate change increase the risk to
    workers and vulnerable populations in and around these
    facilities which too often are low-income communities and
    communities of color.
        Earlier this year, the New York Times reported that more
    than 2,500 sites handling toxic chemicals are located in flood-
    prone areas across the country. It is clear that far more
    remains to be done to ensure chemical facilities are truly
    resilient to this growing threat.
        Mr. Chairman, I also believe we must examine Federal
    chemical safety and security policy holistically. We can't turn
    a blind eye to the administration's actions to undermine the
    efficacy of EPA's RMP program. Preventing terrorism at these
    facilities is important, but accidents and industrial incidents
    due to extreme weather are far more common and they should also
    be given due consideration by this committee.
        We have to ensure the safety and security of workers, first
    responders, and communities living near our nation's chemical
    facilities are being prepared on both fronts.
        And with that, Mr. Chairman--I don't think anybody wants my
    time--I'll yield back.
        Mr. McKinley [presiding]. Thank you, and absent the
    chairman of the full committee, we will now conclude the
    members' opening remarks.
        The chair would like to remind our members that pursuant to
    the committee rules, all members' opening statements be made
    part of the record.
        [The prepared statement of Mr. Walden follows:]

                     Prepared statement of Hon. Greg Walden

        Good morning, Mr. Chairman, and thank you for yielding me
    this time.
        I am glad you have decided to have an oversight hearing on
    the Chemical Facility Anti-Terrorism Standards program--or
    CFATS, which is a program the Committee has been overseeing
    since its inception. This hearing continues Energy and
    Commerce's work this month on Federal preparedness laws for
    deliberate events--like last week's hearing on pandemic and
    health hazard preparedness and response and tomorrow's hearing
    examining the federal reaction to biological attacks.
        In the wake of the terrorist attacks of September 11th,
    Congress assessed Federal authority to address theft,
    diversion, and terrorism at chemical facilities and decided
    accident prevention and process safety laws were insufficient
    to tackle these malicious, and intentional acts. Instead,
    Congress decided a separate and distinct body of law and
    requirements were needed for security purposes. Leaving the
    Clean Air Act to address general safety and accident concerns,
    Congress used CFATS to fill legal gaps in addressing
    intentional acts against this critical infrastructure sector.
    In addition, to avoid overlapping with other Federal programs,
    CFATS was designed to foster collaboration between the
    government and regulated parties.
        Since each chemical facility faces different security
    challenges, CFATS established 18 layered, risk-based
    performance standards for security at chemical facilities. It
    is important to point out that CFATS is a program that not only
    covers huge chemical and petrochemical complexes, but also race
    tracks, wineries and breweries, universities and colleges, and
    hospitals and health care providers--3,400 hundred facilities
    in all.
        However, the CFATS program had to overcome some tough
    years. While there have not been any documented attacks on
    these facilities to date, the program has suffered in the past
    from poor accomplishment numbers, inadequate support from
    senior DHS officials, management and workforce issues, and a
    lack of transparency about the program, especially with the
    stakeholder community. Since we last heard from DHS on the
    status of CFATS, the Department has had four years to correct
    the program and I understand DHS has been steadily making
    progress on these areas. I am eager to find out first-hand what
    that means, not just from DHS, but from some of its past
    critics--the Government Accountability Office and the regulated
    community.
        CFATS must provide value to taxpayers, the Federal
    government, and the facilities that could fall victim to
    intentional attacks. To do that, it needs to not just focus on
    its outputs and become highly proficient at those but stay in
    its lane and not try to emulate or replicate other laws whose
    primary purpose is safety, not security.
        I want to welcome our witnesses for being with us today and
    thank them for sharing their views with us.
        With that, Mr. Chairman, I yield back the balance of my
    time.

        Mr. McKinley. We wish to thank all of our witnesses for
    being here today, taking the time to testify before this
    subcommittee.
        Today's witnesses, beginning with the first panel, will
    have the opportunity to give opening statements followed by a
    round of questions. You know how this works.
        Our first witness panel for today's hearing includes Mr.
    David Wulf, the Acting Assistant Secretary for Infrastructure
    Protection with the Department of Homeland Security.
        Mr. Wulf, we appreciate you being here today and we will
    begin the program with you and you're recognized for your 5
    minutes to make an opening statement.

      STATEMENT OF DAVE WULF, ACTING DEPUTY ASSISTANT SECRETARY,
    INFRASTRUCTURE PROTECTION, U.S. DEPARTMENT OF HOMELAND SECURITY

                         STATEMENT OF DAVE WULF

        Mr. Wulf. Thank you so much, Mr. Chairman. I really do
    appreciate the opportunity to be here and thanks as well to
    Ranking Member Tonko and other members of this committee.
        I am excited to be here to provide an update on the
    progress that the Chemical Facility Anti-Terrorism Standards,
    or CFATS program, continues to make in fostering security at
    high-risk chemical facilities across this nation.
        When I last testified before this committee in 2013, no
    question but that the CFATS program was in a very different
    place, having experienced some significant difficulties in its
    early years. But we had at that point implemented a
    comprehensive corrective action plan and had begun making
    measurable forward progress.
        At the time, I emphasized the importance of long-term
    authorization for this critical anti-terrorism program and I am
    very grateful for the leadership that you all provided--that
    this committee demonstrated in securing the 4-year CFATS
    authorization that was signed into law in December of 2014.
        So as we now find ourselves nearly 3 \1/2\ years into the
    authorization period, I am grateful that this committee is,
    again, taking a lead role in ensuring continuing long-term
    authorization of CFATS.
        Now, as I am sure you'll hear me say once or twice today,
    the stability that has come along with long-term authorization
    has driven unprecedented progress as we have worked with CFATS-
    covered facilities to make America's high-risk chemical
    infrastructure a truly hard target with literally tens of
    thousands of security measures having been put in place at
    high-risk chemical facilities across the nation.
        So the stability afforded by long-term authorization has
    facilitated our planning and execution of important
    programmatic improvements while it has also afforded regulated
    industry stakeholders with the certainty they deserved as they
    planned for and made significant investments in CFATS-related
    security measures.
        I am very pleased that you'll be hearing today directly
    from CFATS industry stakeholders about their direct experience
    with CFATS. Doug Brown, Jamie Conrad, Steve Roberts, along with
    a host of industry associations, have been true leaders in
    promoting a strong culture of chemical security across the
    Nation and I really appreciate their presence and that of the
    other witnesses here today.
        As we are all too aware, the threat of chemical terrorism
    remains a real and very relevant one. Around the globe, we
    continue to see bad actors seeking to acquire and using in
    attacks chemicals of the sort that trigger coverage under CFATS
    and the threat stream continues to reflect that chemical
    facilities themselves remain an attractive target for
    terrorist.
        I can tell you with certainty that the work we are doing in
    concert with our committed stakeholders across the wide variety
    of industries and facilities that compose the CFATS-covered
    universe is making a real difference in protecting the nation,
    and having had the opportunity to work closely with my
    counterparts in other nations and to co-chair the G-7 Global
    Partnerships' Chemical Security Working Group, I can absolutely
    tell you that what we are doing here in the United States
    through CFATS what you have helped build with your support for
    long-term authorization is absolutely the envy of the world.
        With its 18 comprehensive risk-based performance standards
    and its nonprescriptive flexible approach, CFATS is well suited
    to enhancing security across the very diverse universe of high-
    risk chemical facilities.
        So what have we been doing to make CFATS even stronger as
    we have enjoyed the stability of long-term authorization over
    the past 3 \1/2\ years?
        Well, we have improved processes and we have seen
    unprecedented progress in the pace of inspections and in the
    review and approval of facility site security plans,
    eliminating a backlog of security plan reviews 6 years ahead of
    earlier GAO projections.
        We have developed and launched an improved risk assessment
    methodology that effectively accounts for all relevant elements
    of risk and have reassessed the level of risk associated with
    nearly 30,000 facilities across the Nation.
        We have implemented the CFATS personnel surety program,
    affording the highest tiered CFATS-covered facilities the
    ability to ensure that individuals with access to those
    facilities have been vetted for terrorist ties and we have
    significantly reduced burden across our stakeholder community,
    having built and launched a streamlined more user-friendly
    suite of online tools through which facilities submit risk
    assessment or top-screen surveys and develop their site
    security plans.
        So in addition to facilitating all this progress, long-term
    authorization as compared to our former reality of
    authorization through the annual appropriations process enabled
    us to continue to recruit and retain top talent and it reduced
    the possibility of another lapse in authority such as occurred
    during the October 2013 government shut down.
        In addition to the confusion this situation created among
    our industry stakeholders, the need had arisen for us to take
    enforcement action to address the national security threat at a
    CFATS facility during this period of lapse in appropriations.
    The underlying statutory authority for such enforcement action
    would have been in doubt.
        I know this is not a situation that anyone wants to see
    repeated. So to finish on a bit more of a positive note, I
    would, again, like to thank this committee and your top-notch
    staff for your leadership in the CFATS reauthorization process.
        We are fond of saying that chemical security is a shared
    commitment and, not unlike the role of our industry
    stakeholders who have embraced and helped us to build this
    program in so many ways and the role of our committed and very
    talented team at DHS, the role of Congress and of this
    committee in shaping and authorizing CFATS for the long term
    has been hugely important and I am looking forward to working
    further with you as we drive toward reauthorization this year.
        So thank you so much, Mr. Chairman. I look forward to your
    questions and to the dialogue here today.
        [The prepared statement of Mr. Wulf follows:]
        [GRAPHICS NOT AVAILABLE IN TIFF FORMAT]

        Mr. McKinley. Thank you for your testimony, Mr. Wulf, and
    if I could recognize myself for 5 minutes to begin the round of
    questioning.
        Mr. Wulf, last time you testified before the committee one
    of the key issues identified by GAO regarding CFATS was
    Homeland Security's approach to calculating risks and in fact
    they concluded DHS did not take into consideration all the
    elements and consequences of threat risk and vulnerability.
        Your written testimony mentions an enhanced risk assessment
    and tiered methodology that Homeland Security believes more
    accurately reflects a facility risk.
        Has DHS changed its policy to risk analysis?
        Mr. Wulf. Yes. In fact, Mr. Chairman, we have.
        So we took very seriously the dialogue we had with this
    committee--took very seriously the recommendations we received
    from GAO, recognizing that our previous risk-tiering
    methodology was not as comprehensive as they could have been.
    It was very focused on the consequences of terrorist attacks
    and less so on vulnerability and threat.
        We commissioned a peer review with a committee drawn from a
    panel of experts from across academia, government partners, and
    industry. We received some excellent recommendations as to ways
    in which we could enhance our risk-tiering methodology and we
    set about doing just that.
        So in the fall of 2016, we did in fact launch a new and
    improved risk-tiering methodology that accounts for all
    relevant elements of risk. So consequence, vulnerability, and
    threat, and we set about retiering the universe of chemical
    facilities against that new tiering methodology.
        Mr. McKinley. With this tiering methodology, I am just
    curious--has it been peer reviewed what you've done on that
    methodology?
        Mr. Wulf. Yes. It sure has. So after we developed the
    methodology we drew together another group of experts, again,
    from across government academia and our industry community to
    go over the methodology--to make recommendations for potential
    tweaks before we finalized the methodology.
        And following that, we embarked upon a verification and
    validation process that was conducted by Sandia National Labs,
    which advised us that our methodology was in fact sound, was
    working as intended, and at that point, we launched upon the
    retiering process.
        Mr. McKinley. Again, back on the tiers, Mr. Wulf, almost
    half the group changed tiers onto this new methodology. Fifteen
    percent apparently left the program and four became newly
    regulated.
        And so my question is, is what quality reviews and are
    there updates occurring to make sure that you are appropriately
    tiering everybody that should be in the system and, as the
    engineering room counts up the numbers, your numbers total over
    100 percent. So I am curious if there is a discrepancy in your
    math.
        Mr. Wulf. That is a good question. So I would say the way
    to look at the math is, looking at the number of facilities
    that had been previously tiered, that group should add up to
    100 percent.
        So of that group, about 36 percent of previously tiered
    high-risk facilities stayed put at the same tier level.
        About 48 percent, as I think you mentioned, moved across
    tiers from one tier to another and about 15 percent of that
    previously tiered population was determined to be no longer
    high risk, using the new methodology, and fell out of the high-
    risk category.
        So those three numbers add up to 100 percent when you take
    into account the decimals. The additional 4 percent is from the
    population that had previously been not determined to be high
    risk--those previously untiered facilities. Four percent of
    those were subsequently determined under the new methodology to
    be high risk and moved into the risk tiers.
        Mr. McKinley. Just in the time that remains--the 30 some
    seconds--how do we have confidence that you're appropriately
    tiering people, risk-tiering companies.
        Mr. Wulf. So, the risk-tiering methodology is a sound one
    and is very robust and now takes into account all relevant
    elements of risk.
        We have built a system in which human eyes look at tiering
    for each facility as we move through the process and before a
    final tiering decision is issued and if anything looks off--if
    it appears as though a facility might have submitted
    information in a way that doesn't quite make sense, we are able
    to reach out directly through our field inspectors, through our
    compliance case managers directly, to the facility to resolve
    any discrepancies and to ensure that we are in fact issuing the
    correct tier.
        Mr. McKinley. Thank you. Thank you for my question.
        Now, recognize the ranking member, Mr. Tonko from New York,
    for 5 minutes.
        Mr. Tonko. Thank you, Mr. Chair.
        And Mr. Wulf, again, welcome and thank you for your
    testimony. I commend you on the progress that has been made
    over the recent years.
        I believe, however there are ways we can continue to reduce
    risks and improve the program. I want to reference a few issues
    that came up when DHS last testified before this committee on
    the CFATS program. This includes the importance of closing
    security gaps. Is it true that drinking water and wastewater
    facilities are statutorily exempt from the CFATS program?
        Mr. Wulf. Water and wastewater facilities are among the
    statutory exemptions along with facilities regulated by our
    friends in the Coast Guard through the NHTSA program and a
    handful of other exemptions.
        Mr. Tonko. Thank you. And do you think they were exempted
    because there are no risks of terrorist attacks at these sites?
        Mr. Wulf. I was not here when when that exemption went into
    effect. Certainly, I think it might be worth studying what gaps
    may exist in that arena. I think that might be a sound next
    step.
        Mr. Tonko. OK. And is it true that nuclear facilities are
    also statutorily exempt from the CFATS program?
        Mr. Wulf. Facilities regulated by the NRC are exempt.
        Mr. Tonko. And what about Federal facilities that have
    large amounts of chemicals of interest? Are they exempt?
        Mr. Wulf. Facilities owned and operated by the Department
    of Energy and the Department of Defense, both of which have
    robust standards and audit controls of their own, are exempt as
    well.
        Mr. Tonko. Just because a facility is not covered by CFATS
    does that mean it is not a potential target by terrorists?
    Should these sites be monitored at all?
        Mr. Wulf. So, CFATS is very focused. It is a risk-based
    program. It is targeted at the highest--those facilities that
    are assessed to be at the highest risk of terrorist attack or
    exploitation so I think it is an appropriate targeting of our
    best resources to the facilities that are at the highest risk.
        That is certainly not to say that other facilities do not
    present a risk. We have within the Department of Homeland
    Security a suite of voluntary tools and resources that are
    available to other chemical facilities through our chemical
    sector-specific agency.
        We have protective security advisors who work with
    facilities on a voluntary basis across the Nation every day. So
    yes, certainly----
        Mr. Tonko. But that's statutorily imposed. So----
        Mr. Wulf. Yes. Those are not a statutory requirement.
        Mr. Tonko. OK. Obviously, there are very different security
    and regulatory regimes at nuclear facilities--Federal
    facilities--and other sites that have received exemptions.
        But in the past, DHS has expressed concerns over the gaps
    created by these exemptions. A number of years ago, DHS
    testified that the administration's position to support closing
    security gaps at drinking water and waste water facilities--is
    that still the administration's position?
        Mr. Wulf. I think I would have to take that back.
        Mr. Tonko. OK. And does the administration still support
    maintaining EPA as the lead agency for drinking water and waste
    water facility security with the DHS supporting EPA's efforts?
        Mr. Wulf. I think that is another one we would need to take
    back.
        Mr. Tonko. All right. If you can get back to the committee,
    please.
        And can you explain how DHS has worked with EPA in recent
    years to encourage improvements in chemical security at water
    facilities?
        Mr. Wulf. So I can speak more broadly to the work we have
    done with EPA across the chemical sector. So as you probably
    know, in the wake of the tragic explosion at west Texas, an
    Executive order on improving chemical security safety and
    security was issued.
        In implementing that order, we developed a national working
    group composed of us at DHS along with EPA, OSHA, Bureau of
    Alcohol, Tobacco, Firearms, and Explosives and others with a
    role in assuring chemical facility safety and security.
        We took steps to ensure that we were sharing information as
    fully as possibly, comparing notes on inspections, comparing
    notes on facilities that existed in our relative respective
    jurisdictions and ensuring that word was getting out as widely
    as possible about all of the different regulatory and other
    requirements.
        Mr. Tonko. OK. I would simply encourage the committee to
    consider how we might close some of these security gaps before
    we debate creating new ones through additional exemptions and I
    think it's important that we have this holistic approach to
    cover everyone that might be impacted.
        With that, I yield back, Mr. Chair.
        Mr. McKinley. Thank you.
        And now I recognize my colleague from Mississippi, Mr.
    Harper, for 5 minutes.
        Mr. Harper. Thank you, Mr. Chairman.
        Mr. Wulf, thank you for your time being here, and we
    appreciate it. It's such an important issue and topic for us to
    continue to look at and we know that we all want to be on the
    same page here on where we go, what we look at, and how we try
    to strengthen this in the future.
        One of the issues that was identified by the GAO, and also
    a second witness that will be on the next panel, as a place
    that needed improvement was compliance, inspections, and
    enforcement, and I'd like to know what steps DHS has taken to
    improve in this area.
        Mr. Wulf. I appreciate the question. We have made really
    unprecedented progress in our conduct of inspections in our
    review and adjudication of site security plans and have moved
    as well in--as a result have enclosed the backlog of site
    security plan reviews and adjudications.
        We have moved now into steady state phase of the program.
    So, more than 90 percent of the inspections we are now
    conducting for post site security plan approval, compliance
    inspection, variety of inspections. So we have developed
    standard operating procedures for these inspections and I will
    say that the inspections that are happening across the country
    are going well almost across the board.
        Facilities are taking seriously their obligation to
    implement their site security plans. They are putting in place
    planned or new security measures in accordance with agreed upon
    timelines where issues are being identified or found by
    inspectors.
        Nearly always they are being resolved quickly and in good
    faith by the facility. We are not hesitant though where needed
    to use the enforcement authorities with which we have been
    entrusted.
        But our overwhelming bias continues to be to work with
    facilities that are working with us in good faith to come into
    compliance.
        Mr. Harper. Mr. Wulf, let's talk about your--the inspectors
    for just a moment. Is there a--does DHS have minimum
    qualification requirements for inspectors so they could
    demonstrate the knowledge and understanding of the facilities
    that they encounter and relevant guidance on enforcement
    requirements.
        Do you have the minimum qualifications there and, if yes,
    will you provide the committee any written items the department
    has governing inspector qualifications and training?
        Mr. Wulf. Glad to do that, sir, and absolutely, we have
    minimum standards--a pretty high bar for those standards as
    well for our inspectors who go through a comprehensive training
    program when they first come on board at DHS and to whom we
    provide advanced training throughout their careers on specific
    topics such as cybersecurity or personnel surety background
    check focused program among many others.
        There is an exam at the end of the basic training and it is
    rigorous. We also focus heavily on on-the-job training and on
    fostering consistency across our inspector cadre and the
    inspections they conduct.
        We have put in place relatively recently a group of senior
    inspectors in each of our 10 regions and their job is to foster
    training, the development of our inspector cadre and to ensure
    that we are working in a consistent way. But absolutely glad to
    provide you information.
        Mr. Harper. And that would be great. Obviously, the goal
    here is that if you had any inspector come in to any facility
    that there would be a consistent review and finding, do you
    sense that the ongoing training for those inspectors is going
    to meet that?
        Mr. Wulf. Yes, I do. I think, it's never completely
    perfect. We strive for absolute consistency. We appreciate the
    feedback we receive from our industry stakeholders, many of
    whom own and operate companies that have facilities in
    different parts of the country and, if we hear things are
    perhaps a little different in one part of the country than the
    other, we work quickly to address that.
        In some cases there are reasons for that. It may be that,
    one of the kind of game changing things we have done as an
    organization is to begin to take more of a corporate approach
    to inspections.
        So we are looking at a number of issues at the corporate
    headquarters level so if there are policies that apply across
    facilities it may be that a company's facility that is hit from
    an inspection standpoint early on in the process it might
    appear to that facility that it's getting a little more
    thorough treatment than one that's hit later in the process.
    But that is likely only because we have ----
        Mr. Harper. My time has expired, Mr. Wulf. My time has
    expired. Thank you so much, and I yield back.
        Mr. Wulf. Thank you so much.
        Mr. McKinley. Thank you, and now 5 yield 5 minutes to one
    of my latest friends, Mr. Peters from California, for 5
    minutes.
        Mr. Peters. Thank you, Mr. Chairman.
        Thank you, Mr. Wulf, for being here today. I want to
    commend you for the improvements in the CFATS program over the
    last few years.
        A longer-term authorization or focus on fixing the known
    deficiencies in program management have helped to eliminate the
    site security plan backlog and start the process of compliance
    inspections.
        However, a program can only be as good as the statute that
    authorized it. So I wanted to talk a little bit about how we
    might improve the statute, if you thought that was useful,
    starting with effective enforcement.
        In your testimony, you note that where issues have been
    identified during inspections they have nearly always been
    quickly remedied where needed. However, we have utilized our
    enforcement authorities to incentivize compliance.
        So can you explain to me, Mr. Wulf, what kind of types of
    enforcement mechanisms you've been able to use under the
    program?
        Mr. Wulf. So yes, I appreciate the question. So the
    enforcement process within the program I think is in line with
    the flexible nonprescriptive approach to the program and our
    general orientation to work with facilities to foster
    compliance.
        So where issues are identified on inspections, we work with
    a facility, assuming the facility is working with us in good
    faith to resolve them.
        So, occasionally, if, for instance, a planned measure that
    has been agreed in the site security plan to be put into place
    on a certain timeline has slipped on that timeline, it may be
    that there has been a change in personnel, sort of a lack of
    understanding of what was in the site security plan.
        We will work on an agreeable quick time frame to get that
    planned measure in place and frequently those sorts of things
    are resolved at that point.
        If we get into the enforcement structure it is a two-step
    process. The first step involves the issuance of essentially, a
    notice of noncompliance, which gives a facility formally a
    certain period of time, generally, not too much time to come
    into compliance and I am pleased to say before a penalty order
    is issued--I am pleased to say that 95 percent of the cases
    that is enough to bring the facility into compliance.
        Where if we get to a point where a facility has run through
    that period we will go ahead and issue a penalty order. We do
    take into account facility status as potentially, a small
    business, a facility's ability to pay in determining the
    ultimate penalty.
        It's only happened in a small number of cases.
        Mr. Peters. I was going to ask you, so how many times have
    you had to use penalties or cease operation orders for
    facilities that aren't executing their----
        Mr. Wulf. So we have issued penalty orders in three
    instances at this point.
        Mr. Peters. Three instances. OK.
        So that's the number of times you had to enforce against a
    noncompliant facility?
        Mr. Wulf. That's the number of times we have gotten to the
    point of----
        Mr. Peters. To that point, right.
        Mr. Wulf. A penalty, probably in about 70 occasions begun
    the process.
        Mr. Peters. Great. And do you see that the bill that acts
    as it's written--does it give you enough authority to do what
    you have to do? It sounds like that's going fairly well.
        Mr. Wulf. I believe that we have the authority that we need
    to do to foster security at America's highest-risk chemical
    facilities.
        I think it is a regulatory framework that is really well
    suited to the mission at hand and to the diversity of America's
    chemical infrastructure.
        Mr. Peters. Great. Just one other topic then--the effective
    and adequate enforcement mechanisms are crucial to preventing
    noncompliance. We saw the dangers of noncompliance when the
    West Fertilizer Company in West, Texas exploded.
        Facilities that don't report their holdings to DHS and are
    otherwise not identified to the department still pose a risk to
    workers, first responders, and surrounding communities.
        What kind of steps have you taken to address the problem of
    these so-called outlier facilities?
        Mr. Wulf. Yes. So, certainly, a high priority for us,
    ensuring that we are getting the word out as widely as possible
    to facilities about their obligations to report information to
    us through the top-screen.
        So we work through industry associations. We participate in
    conferences. We drill down to the state and local level through
    state industry associations, though recognizing that not all
    chemical facilities, companies are members of these
    associations.
        Wee get creative. We work through----
        Mr. Peters. I am going to run out of----
        Mr. Wulf [continuing]. The state and local law enforcement,
    preparing lists of facilities and comparing information about--
    --
        Mr. Peters. We are out of time. But I have 5 seconds for
    you to tell us if there is anything Congress can improve in
    this area. Is there anything you would ask us to improve within
    the law?
        Mr. Wulf. No. I think we have what we need from an outreach
    standpoint.
        Mr. Peters. Thank you.
        Mr. Chairman, I yield back.
        Mr. McKinley. Thank you, and the chair now recognizes Mr.
    Johnson from Ohio for 5 minutes.
        Mr. Johnson. Thank you, Mr. Chairman, and Mr. Wulf, thanks
    for joining us today.
        I've heard concerns that any changes to Appendix A
    including through guidance might not be subject to notice and
    comment.
        So would changes to Appendix A by guidance be subject to
    public notice and comment based on requirements of OMB?
        Mr. Wulf. So yes, I appreciate the question, and Appendix A
    is a list of chemicals of interest--320 or some chemicals--is
    part of our regulation and so, under the Administrative
    Procedures Act it cannot be adjusted or changed without going
    through the notice and comment rulemaking process. So as things
    currently stand, that would be the----
        Mr. Johnson. Even through guidance?
        Mr. Wulf. Pardon me?
        Mr. Johnson. Even through guidance.
        Mr. Wulf. That's right.
        Mr. Johnson. OK.
        Mr. Wulf. I think it would be considered significant
    guidance that would need to go through notice of rulemaking.
        Mr. Johnson. OK. Great.
        Previously, GAO indicated that DHS does not systematically
    solicit feedback to assess the effectiveness of outreach
    efforts and does not have a mechanism to measure effectiveness
    of your outreach activities.
        Mr. Currie, in his written testimony, indicated that DHS
    developed a questionnaire to solicit feedback on outreach with
    industry stakeholders.
        Would you please walk us through the questionnaire and
    explain whether it's been effective?
        Mr. Wulf. Yes. Absolutely. I am glad to do that.
        So, we have taken GAO's recommendations seriously. As you
    mentioned, we have developed that outreach questionnaire. I do
    believe it is effective. We are in the relative early stages of
    its deployment.
        We are using it as we go out to conferences as opposed to
    going facility by facility during inspections or compliance
    assistance visits.
        We ask in this questionnaire those who participate in our
    engagements to give us some feedback on the content, on the
    speaker, on the relevance of the information, on the extent to
    which they expect to be using the information to inform their
    chemical security risk-based decisions.
        You know, the challenge sometimes is to get the
    questionnaire into the hands of the people who have actually
    participated in the event as we are guests at these
    conferences. We don't necessarily control the attendee email
    distribution lists.
        So we work with organizers of the conference to push it
    out. To this point, we have received upwards of 60 responses
    back. Ninety-seven percent of those who responded reported that
    information was relevant and highly useful.
        So we are going to continue to look at how we can expand
    the use of the questionnaire. I think it is very much a
    worthwhile tool.
        Mr. Johnson. Good. OK.
        Well, since the last time the department testified before
    our committee the Government Accountability Office has made 10
    recommendations for improvements to the CFATS program.
        What progress have you made on those recommendations?
        Mr. Wulf. I appreciate that, and I appreciate GAO's
    engagement and very helpful oversight and recommendations over
    the course of the year.
        I am confident that we are among the most thoroughly
    scrutinized programs in the government and pleased that GAO has
    recognized our significant forward progress over the year and,
    happy to report that we have made a lot of progress in
    implementing GAO's recommendations.
        I think those recommendations, broadly speaking, fall into
    a couple of different bins. One of those focused on our risk
    assessment process, our tiering methodology.
        We, as I've mentioned in this hearing, made a lot of
    progress in developing our new risk-tiering methodology, one
    that comprehensively accounts for all relevant elements of
    risk. Along with that, we have launched a new and very much
    streamlined and user-friendly suite of online tools to
    facilitate tiering.
        I am confident that when GAO issues its next report it will
    recommend or it will close out the remaining recommendations
    related to our development of our tiering methodology--the
    conduct of the tiering peer review among other tiering-related
    issues.
        The second bin I think concerns, broadly, our internal
    processes and controls and, we have made a lot of progress on
    that front, too, executing a 95-point action plan to improve
    the program, developing standard operating procedures on things
    like enforcement and on the conduct of inspections, developing
    metrics to measure the effectiveness of the program and,
    pleased to report, based upon those metrics, facilities that
    are within the program have enhanced their security very, very
    measurably under CFATS. It's a program that is working.
        Mr. Johnson. Well, great. Well, thank you for your
    responses. I yield back, Mr. Chair.
        Mr. McKinley. Thank you.
        And I now recognize our colleague, Mr. Green from Texas,
    for 5 minutes.
        Mr. Green. Thank you, Mr. Chairman.
        Secretary Wulf, thank you for being here. I have a very
    urban district in Houston in East Harris County that's home to
    one of the largest petrochemical complexes in the world so I
    know how important CFATS is and I'd like to thank you for your
    work in implementing these safety standards, and I'd heard a
    lot of good things about the work.
        I was glad in your earlier testimony or question you
    acknowledged that CFATS, because it was called anti-terrorism
    standards, we are more likely to have a natural disaster than
    we are a terrorist.
        In fact, in my area, I think we could take care of the
    terrorists pretty quickly. As I say in Texas, we don't have any
    shortage of small arms. So but Hurricane Harvey that hit our
    community--and I know the other issue was the--that facility
    out in Crosby, Texas, and that's not my area but East Harris
    County is.
        But a lot of our refineries literally were under water in
    the Houston Ship Channel and that's what my concern is and
    maybe we need to focus on that, although, admittedly, when we
    passed the Chemical Facilities Anti-Terrorism Standards program
    we didn't think about natural disasters.
        But now we need to recognize that because about every 7
    years in Houston, Texas or southeast Texas we get a tropical
    storm or a hurricane, and although the last one with Harvey I
    don't know how we could ever plan for 55 inches of rain in 4
    days.
        So but can you talk about how subjecting CFATS to a yearly
    authorization through the appropriations process before 2014
    put a burden on the program?
        Mr. Wulf. Yes, absolutely. Glad to. Until we attained long-
    term authorization, we were subject to the vicissitudes of the
    appropriations process.
        So going from year to year or, worse, from continuing
    resolution to continuing resolution. When the government shut
    down----
        Mr. Green. I think every federal agency has that problem.
        Mr. Wulf. Yes. When the government shut down in October or
    November--October 2013, our stakeholders didn't know whether
    CFATS continued in force.
        We didn't know if we needed to take enforcement action to
    address a national security threat at a CFATS facility, whether
    the underlying statutory authority was in existence.
        So long-term authorization in December of 2014 was huge for
    us. It enabled us to plan for and execute important
    improvements to the program, some of which I have detailed here
    today.
        It provided our industry stakeholders with the certainty
    that they deserved as they thought through making significant
    investments in CFATS-focused security measures.
        So I cannot underscore enough how important continuing
    long-term authorization for the program is.
        Mr. Green. Do you think we need to put specific language in
    there? Because when we have these shut downs that our committee
    doesn't have a whole lot to do with since we are not
    appropriations.
        Mr. Wulf. Yes.
        Mr. Green. But our military still functions. Our law
    enforcement functions. Why would we not want our terrorism
    safety or even if there is a natural disaster during a shut
    down? So do you think we need specific language to say that?
        Mr. Wulf. So I think the language we have in the current
    authorization does the trick there.
        But I think you have summed up exactly the importance of
    longer-term authorization to continue--the program continues in
    force regardless of what is happening on the appropriations
    front.
        Mr. Green. Do you currently feel that the facilities
    labeled high risk have enough incentive through the program to
    reduce that risk and do you see facilities switching tiers
    commonly after a high risk designation?
        Mr. Wulf. So, as we have gone through the retiering process
    using our new risk tiering methodology, we have seen some
    shifting across tiers. We have seen some new facilities come
    into the program, some previously designated high-risk
    facilities move out of the program. But I do think that
    organically the CFATS program promotes the consideration by
    facilities of safer processes, consideration of different
    chemicals.
        So, there is an incentive for facilities to lower their
    level of risk by doing things differently based on the CFATS
    program and over the course of the program we have seen about
    4,000 facilities that have changed their processes, changed
    their chemical holdings, and dropped out of high-risk status,
    which we view as a good thing.
        Mr. Green. Well, in a way that's good--they are responding
    to the threat. Has the industry response been in revamping of
    the chemical safety assessment tool, or CSAT?
        Do you feel the program is now easy enough to comply with
    if you're a small-scale manufacturer?
        Mr. Wulf. Yes, I do. I think we made some significant
    strides forward with CSAT 2.0, that new online suite of tools.
    The amount of time it now takes facilities to work through the
    process of submitting a top-screen or a site security plan has
    been cut by about 75 percent across the board.
        The tool is much simpler. It's more of a Turbo Tax sort of
    model. Duplicative irrelevant questions are no longer seen by
    facilities. So greatly simplified and we have had really
    tremendous feedback from our industry stakeholders on it.
        And, in many respects they helped us to develop it. They
    were closest to the pain of working through the old system.
    They were able to help us understand ways in which we could
    simplify it and make it more user friendly.
        Mr. Green. Well, Mr. Chairman, thank you for your patience.
    In my area, we don't have those smaller facilities that you
    have.
        Mr. Wulf. Yes, I know.
        Mr. Green. Chemical plants and refineries who run 250,000
    barrels a day. So but I know that we like to go where the
    problems are, not just be a paper pusher.
        So thank you, Mr. Chairman.
        Mr. Wulf. Yes. You're in the center of the petrochemical
    universe.
        Mr. McKinley. Thank you.
        And the chair now recognizes Mr. Duncan from South Carolina
    for his 5 minutes.
        Mr. Duncan. Thank you, Mr. Chairman.
        Back in 2014, I was on the Homeland Security Committee and
    I worked with them to help reauthorize CFATS for 4 consecutive
    years.
        H.R. 4007, Protecting and Securing Chemical Facilities from
    Terrorist Attacks Act of 2014 was under jurisdiction of both
    Homeland and Energy and Commerce. Now we are back to yearly
    funding extensions and this creates instability for both DHS
    and companies operating under the program.
        If Congress were able, Mr. Wulf, to provide multi-year
    authorization like we did back in 2014 how can we ensure DHS
    will update the program as intended?
        Mr. Wulf. So we are very incentivized to try to continually
    improve the program. I think a long-term authorization gives us
    the stability that we need to focus on those improvements.
        We have made a number of them over the course of the last 4
    years. We are eager to push forward through the rule making
    process to engage with our stakeholders through notice and
    comment in a number of different areas----
        Mr. Duncan. How can we be certain that you will take the
    stakeholders' comments into consideration?
        Mr. Wulf. I think we have demonstrated over the course of
    the last 4 years that we take very seriously our stakeholders'
    comments and that we seek to involve them in the program.
        This whole effort is a shared commitment. It wouldn't work
    without the buy-in of our stakeholders. We have put into place
    tens of thousands of security measures at facilities across the
    country.
        So, they know in many ways best ways in which we can
    improve the program. That's why we have involved them in the
    development of the new risk-tiering methodology. That's why we
    have involved them in the development of the new suite of
    online tools and their input on those fronts has been
    invaluable.
        Mr. Duncan. I think as long as they know how to comply and
    what you're going to expect of them it makes it easy for them.
        Let me shift gears for just a minute. There is a company in
    my home county, Austin Powder, and it's a company facility
    there in Clinton and previously noted how duplicate regulations
    cost them substantial amounts of money.
        The facility has explosive regulated both by the ATF and by
    DHS under CFATS. The compliance mandated under CFATS does not
    measurably improve their facility security. It seems ATF
    adequately protects against theft and diversion.
        So given the cost of compliance, which stakeholders in the
    explosives industry face in return for no measurable security
    gain, what is your opinion on exempting those in the explosive
    industry already regulated by ATF from the CFATS program?
        Mr. Wulf. So we are certainly sympathetic--sensitive to
    concerns about duplicative regulation. I think in the case of
    explosive materials, there is regulation in place with ATF.
        I think we are talking about a universe of about 30
    facilities that are regulated both by CFATS for explosives only
    and also by ATF. ATF and DHS have different programs but I
    think they are both solid programs. So, we are open to working
    with the committee on a path forward there.
        I am not sure I completely agree with the premise that
    CFATS doesn't provide any additional security benefit but there
    are certainly measures in place at ATF-regulated facility. I've
    spent a dozen years myself at ATF. A very solid program there.
    And so, among the things that I would not lose too much sleep
    over exiting the program, explosives are one of those.
        I will note, though, that ATF's program does not address
    explosives' precursor chemicals. So, I think many of those
    facilities receive benefits still under CFATS with respect to
    the regulation of security of explosives' precursor chemicals--
    for instance, ammonia nitrate.
        Mr. Duncan. So do you think the redundancy and overlap of
    regulations are OK? I don't hear a whole lot of jurisdictional
    prejudice in your answer there.
        We are going to look at that. We are going to look and see,
    because what we are trying to do is make sure that businesses
    aren't faced with multiple compliance burdens when one agency
    can handle it, and we run into that too much in government, I
    think, where you've got this jurisdictional overlap and one
    agency is coveting that and they don't want to give it up when
    there maybe be a better agency that can handle it. And in this
    case, DHS might be the best agency and take it away from ATF--I
    don't know that--or vice versa.
        Mr. Wulf. Yes. We are happy to work with you on that.
        Mr. Duncan. Thank you.
        Mr. Chairman, I yield back.
        Mr. McKinley. Thank you. Now I recognize my colleague, Mr.
    McNerney from California, for 5 minutes.
        Mr. McNerney. I don't know if I sense a little reluctance
    in that acknowledgment, Mr. Chairman.
        I thank the panelist. Mr. Wulf, I missed your testimony and
    I apologize about that. Now, there are several categories of
    threats. I am going to list a few of them.
        There is natural disasters. There is physical attacks.
    There is industrial accidents and cyber attacks. Do you feel
    that cyber attacks are on par with the others in terms of risk
    to public safety and health?
        Mr. Wulf. I think cyber is a very important threat vector
    and I think that, no question but that America has critical
    infrastructure and that includes America's chemical
    infrastructure is in the cross-hairs of cyber criminals.
        Mr. McNerney. Well, I've learned from the utility industry
    that there is some difficulty getting information sharing
    across because of lack of security clearance within the utility
    industry mainly because of the length of time it takes to get a
    security clearance.
        So you think that that is also an issue with the chemical
    industry is a lack of security clearance within the industry
    prohibiting information sharing that could be helpful in safety
    areas?
        Mr. Wulf. I think, certainly, getting appropriate folks
    across the industry cleared to receive classified threat
    information is helpful.
        We maintain a program called the private sector clearance
    program through which we grant clearances to folks in the
    private sector to include those who serve on our sector
    coordinating counsels.
        So I think, certainly, to the extent we can streamline that
    process, that's a good thing.
        Mr. McNerney. Would it be helpful for the legislative
    branch to get involved in streamlining that process or would
    that be cumbersome?
        Mr. Wulf. I think we are working the issue. It is a high
    priority for us. I think it's sort of a process thing, in my
    view, that, we need to continue to focus like a laser beam upon
    and we are certainly committed to doing that.
        Mr. McNerney. Well, suppose someone goes into the industry,
    say, from the Department of Energy with a pretty high clearance
    level--a Q clearance or some clearance--top secret clearance.
    How long would it take them to get the clearance to get
    information sharing once they go into industry?
        Mr. Wulf. Yes. I would hope not very long. I might have to
    get back to you on exact time lines.
        Mr. McNerney. Yes. I have a specific case where it took
    someone with a top secret clearance 18 months to get a secret
    clearance in industry.
        Mr. Wulf. Yes, not good.
        Mr. McNerney. OK. Well, I'd like to follow up on that and
    hear specifically how that that's going to be----
        Mr. Wulf. Happy to talk with you more about that program.
        Mr. McNerney. OK. Do you think that there is--on a
    different subject, is there resistance to safety regulations by
    industry of regulations that actually provide safety to the
    public?
        Mr. Wulf. Although our security-focused regulation has
    positive benefits from a safety standpoint, I don't know if I
    am in a position to talk about the extent to which there may or
    may not be resistance to EPA's or OSHA's safety-focused
    regulations.
        I would hope not. I think there is a strong culture across
    the chemical industry of safety and security. So my expectation
    is that they are meeting requirements across the board.
        Mr. McNerney. Right. It just takes one bad player to cause
    an accident to hurt the whole industry.
        Mr. Wulf. Yes. Absolutely.
        Mr. McNerney. So I think we both and industry understand
    that and are anxious to work with regulatory bodies such as
    yours.
        Mr. Wulf. Yes.
        Mr. McNerney. OK. Mr. Chairman, I am going to yield back.
    I'll give you a minute.
        Mr. McKinley. Thank you.
        Now the chair recognizes Mr. Flores from Texas for 5
    minutes.
        Mr. Flores. I thank the chairman and I thank this
    subcommittee for holding this important hearing.
        On April 18th, 2013 one of the communities in my district,
    that being West, Texas experienced a disastrous explosion that
    took 15 lives. Twelve of them were first responders. So CFATS
    is important to me and to my district.
        Furthermore, it was really disturbing to learn from the
    findings that were released 3 years later that this wasn't an
    industrial accident. It was actually arson.
        That said, the citizens of West deserve great credit for
    how they've been resilient in rebuilding their community and
    the rebound of West today is really remarkable.
        As the current authorization for CFATS is set to expire in
    January of next year, we must carefully consider how the
    program is measured and what improvements should be made or
    could be made in the reauthorizing legislation.
        I want to thank all of today's witnesses for their insight
    in this hearing. And so now I'll move to my question for Mr.
    Wulf.
        Some people argued that the greater public sharing of
    chemical vulnerability information--or the CVI, as we call it--
    is necessary for communities to be better prepared.
        So, Mr. Wulf, I have three subquestions under that. First
    of all, to whom does Section 2103 currently allow access to
    CVI?
        Mr. Wulf. So that section of the statute currently allows
    access to state and local government officials who essentially
    have a need to know that information in performing their
    official duties in the first response arena--emergency planning
    arena.
        Mr. Flores. So the next question would be do you think it's
    wise to have CVI publicly disclosed?
        Mr. Wulf. I do not. The reason we developed the chemical
    terrorism vulnerability information protection regime was to
    keep close hold among those who have a need to know information
    about high-risk chemical facilities and the chemical holdings
    at those sites.
        Mr. Flores. OK. And so that brings us to the next one. Some
    people have suggested that local emergency planning commissions
    should have access to CVI. Is there a reason to not provide it
    to them?
        Mr. Wulf. So local emergency planning commissions perform
    an important function. But they vary in their--in their
    composition. So there are certainly folks who are members of
    local emergency planning missions who do have a need to know
    information about high-risk chemical facilities and chemical
    holdings.
        So those first responders, those emergency planners, we
    absolutely want to ensure that they have the information they
    need to perform their official duties.
        But we need to balance that with the need to ensure that we
    are not sharing so broadly that we make it easy for terrorists
    and other adversaries to obtain information to effectively have
    a roadmap to America's highest risk facilities.
        Mr. Flores. If you have first responders that are CVI
    trained, would it be appropriate to share the information with
    those first responders?
        Mr. Wulf. Absolutely.
        Mr. Flores. OK. Mr. Chairman, this has been helpful and I
    thank you.
        I yield back the balance of my time.
        Mr. McKinley. Thank you very much, and now the chair
    recognizes Mr. Cardenas from California for 5 minutes.
        Mr. Cardenas. Thank you very much, Mr. Chairman. I
    appreciate the opportunity to discuss this very, very important
    issue that affects all Americans.
        Thank you for being here, Mr. Wulf. Earlier this year at a
    subcommittee hearing before the House Committee on Homeland
    Security, chemical safety advocate Paul Oram testified that
    facility owners should be required to develop and maintain
    employee input plans.
        Mr. Oram commented that, ``Employees are often the most
    vulnerable in the chemical release but also the most
    knowledgeable about problems and remedies.''
        So with that, has DHS encouraged or required facility
    owners to consult with employees when developing security
    vulnerability assessments?
        Mr. Wulf. So I appreciate the question. We certainly urge
    companies--we urge high-risk facilities to involve their
    employees in development of site security plans and I would say
    that almost across the board employees are involved in the
    development of those plans.
        The 2014 long-term authorization act makes clear that to
    the extent practicable, facilities should be involving employee
    and my expectation and my general understanding is that
    facilities are doing just that.
        I mean, facility employees are the ones developing plans.
        Mr. Cardenas. So the facilities' owners--these plants
    voluntarily give that feedback to you? If it's not one of the
    checklist things that the department asks, by the way, do you
    have an employee input plan on your site?
        Mr. Wulf. It is not a checklist thing. We are not really a
    checklist program. But we are a program that engages very
    constructively with facilities. So that is voluntary feedback.
    That's the experience----
        Mr. Cardenas. OK.
        Mr. Wulf. --of our inspectors working with these
    facilities.
        Mr. Cardenas. So that feedback right now is ad hoc? It's
    just as----
        Mr. Wulf. I don't know if I'd characterize it as ad hoc,
    and there is not a check box.
        Mr. Cardenas. OK. Well, I'll describe it as ad hoc if there
    is not a formal process. Five years ago when the last oversight
    hearings on the CFATS program then under Secretary Rand Beers
    noted on the record that the department's strategic
    communications plan may eventually include ``systematic
    outreach to facilities including employees at the facilities.''
        Has systematic outreach become the norm in the CFATS
    program?
        Mr. Wulf. Yes. I am pleased to say that it has and we have
    an outreach engagement plan. We identify areas of priority from
    year to year and we focus on ensuring that we are getting the
    word out to those relevant communities and that certainly
    includes to the organized labor--relevant organized labor
    communities.
        Mr. Cardenas. Mr. Oram also stated that public confidence
    is critical to the success of the CFATS program and the secrecy
    is not in the best interest of the communities.
        I couldn't agree more. As a parent, I would not want to
    know if I lived down the street from a facility that puts my
    family at risk. I would want to know as much as we believe
    possible.
        Do you agree that this is important to proactively engage
    communities living near or next to these facilities?
         Mr. Wulf. So I think, again, it's a balance. I think we
    need to ensure that those who are charged with protecting our
    communities, our first responders, our emergency planners have
    the information that they need. The balance, though, is in
    ensuring that we are not making sensitive information so widely
    available that it can be accessed by those who would seek to do
    harm to the community. So it's a balance.
        Mr. Cardenas. So what, if any, specific steps has DHS taken
    to improve community outreach and engagement through the CFATS
    program?
        Mr. Wulf. So, as part of our outreach engagement plan we
    are out talking to local emergency planning committees. Those
    can include members of--and frequently do include members of
    the community and public officials, first responders, emergency
    planners. That is one of the main means by which we are out
    across the relevant communities.
        Mr. Cardenas. Thank you. I can't stress enough how
    important it is for employees and local members of the
    community to be involved in disaster assessment and
    preparedness process.
        These individuals are the ones bearing the greatest risk.
    They work, live, shop, walk to school, pray, and drive to jobs
    near these facilities and they might be at high risk and they
    need to know about that. And yet, they are often left in the
    dark when it comes to disaster preparedness. Their voices are
    critical to the facility and community safety and I hope that
    we can work together to improve engagement efforts under the
    CFATS.
        So I appreciate your time. Thank you very much. I yield
    back.
        Mr. Wulf. Thank you.
        Mr. McKinley. Thank you very much.
        The chair recognizes Mr. Walberg from Michigan for 5
    minutes.
        Mr. Walberg. Thank you, Mr. Chairman, and thank you, Mr.
    Wulf, for being here.
        In your written testimony you indicate that DHS has
    conducted over 3,500 compliance inspections and that, and I
    quote your statement, ``Nearly across the board results of
    these inspections have been positive.''
        That's good. Could you elaborate a little bit more for us?
        Mr. Wulf. Yes. No, I am glad to.
        So we are in sort of steady state compliance inspection
    phase. Most of the inspections we are doing across the country
    are post-site security plan approval inspections.
        So we are assessing the extent to which facilities are
    doing what they signed up to do in developing their site
    security plans, whether they are implementing those plans,
    whether they are putting in place new security measures along
    the time lines agreed to in the plans and I'd say almost across
    the board that is absolutely happening. That has been our
    experience in conducting these inspections.
        Where we have identified issues nearly always we are able
    to resolve those with the facility in pretty short order.
        So, the chemical industry stakeholder community is taking
    its obligations seriously under CFATS. Those facilities that
    have been identified as being at the highest risk of terrorist
    attack or exploitation that are covered by CFATS are taking
    their obligations seriously and are implementing their plans.
        They have put into place literally tens of thousands of
    security measures at facilities across the country. So, really
    appreciate their commitment to the program and their buy-in.
        Mr. Walberg. Do you sense and your inspectors sense that
    they see you as a partner with them--that it's a benefit and
    not a burden?
        Mr. Wulf. I do. Yes, I do. And I think, the program is one
    that lends itself to a little bit of that partnership approach.
    Certainly, we are regulators.
        But this is a nonprescriptive regulatory framework. So we
    are in a position to work with facilities to identify security
    measures within a site security plan that make sense, given
    that specific facility's unique circumstance.
        So, really pleased to be able to work with facilities that
    way, and we will say also that we prioritize not just being out
    there to conduct inspections but to provide compliance
    assistance.
        So to talk with facilities, to talk with those who own and
    operate those facilities about options for meeting the spirit
    of the 18 CFATS risk-based performance standards.
        So, I think it is a really unique and--I want to say
    uniquely effective program that is well suited to the diversity
    of the Nation's chemical industry infrastructure.
         Mr. Walberg. I encourage that. We certainly know of other
    entities that are involved in regulating and inspecting at the
    work site, at the business, that there is no relationship. This
    seems to be a partner relationship.
        Mr. Wulf. Yes.
        Mr. Walberg. This is an important----
        Mr. Wulf. Absolutely, and we rely on our industry
    stakeholders very much to help us think through potential
    improvements to the program, to develop new tools like our new
    and improved suite of online tools through which top-screens
    and site security plans are developed to help us develop things
    like our new risk-tiering methodology.
        So, in a lot of ways it is a thriving partnership
    relationship with our entire stakeholder community. I am very
    grateful for that.
        Mr. Walberg. Thank you.
        Your written testimony notes that where necessary DHS has
    utilized our enforcement authorities to incentivize compliance.
    Can you elaborate on that? Explain that a little more?
        Mr. Wulf. Yes. I am glad to.
        So we have a two-step enforcement process. As I mentioned,
    the vast majority of the time we are able to resolve issues
    without getting into the enforcement process.
        But in about 70 instances over the history of the program
    we have begun the process. We have issued a notice of not
    compliance that, under the law, gives a facility a specific
    amount of time to come into compliance.
        I am happy to say that most of time that is sufficient
    where cooperative work with the facility has worked to nudge
    the facility into compliance.
        But if that doesn't work we will go ahead and issue a
    penalty order, and in all cases--and it's only three cases in
    which we have had to get to the penalty order--that has been
    the thing that has compelled compliance.
        So our overwhelming bias is to work with facilities and,
    certainly, the vast majority of facilities out there are
    acting, in my experience, in good faith and are committed to
    the program and understand--committed to meeting their
    obligations under CFATS.
        But in the small number of instances where that is not
    happening, we will go ahead and use those enforcement
    authorities.
        Mr. Walberg. Thank you.
        I yield back.
        Mr. McKinley. Thank you very much.
        Now the chair recognizes Ms. Matsui from one of the three
    possible states of California for the next 5 minutes.
        Ms. Matsui. I think we are still going to be united--still
    one state.
        Thank you, Mr. Chairman. Today we have talked a lot about
    the industries and facilities that we calmly associate with
    chemicals. But the CFATS program also covers many types of
    facilities that we don't always think of as using high-risk
    chemicals like hospitals and universities.
        In Sacramento, we have four major hospital systems
    including an academic medical center, which represents the
    second largest employer in the district.
        So I am pleased that DHS has emphasized the importance of
    stakeholder involvement, and I've also heard that the agency
    and hospitals in California collaborate well.
        You've emphasized the CFATS as a nonprescriptive regulatory
    framework, which gives flexibility to regulated facilities.
        What are some of the unique challenges that hospitals face
    under CFATS and how has DHS worked with hospitals to tailor
    security measures to those challenges?
        Mr. Wulf. And I appreciate that question. You're absolutely
    right. The universe of facilities covered under CFATS is a very
    broad one.
        So, we prioritize getting out across the relevant
    communities and working to address the unique circumstances of
    facilities such as hospitals.
        So hospitals, college university campuses can't necessarily
    be secured in the same way as a more traditional chemical
    manufacturing or chemical distribution site.
        We need to maintain reasonably open access to the site. You
    have members of the public coming in and out so, what we have
    recommended in cases like that and in the conduct of our
    compliance assistance with those sites is taking kind of an
    asset-based approach to security.
        So you're not necessarily constructing a perimeter around
    the entirety of the hospital but ensuring that where those
    sensitive chemicals are being held you have the requisite
    security in place. So that tends to be the approach for
    facilities such as hospitals.
        Ms. Matsui. OK. Thank you.
        I understand the CFATS has improved its risk-based
    performance standards and risk calculations based upon actual
    threat level and facility vulnerability.
        It makes me wonder--as climate change is increasing the
    frequency and severity of extreme weather if the CFATS couldn't
    be used to address weather-related vulnerabilities.
        Recently, the Chemical Safety Board released their
    investigative report on the Arkema chemical plant fire and
    explosion in Crosby, Texas. The CSB found that the plant was
    not adequately prepared for the extreme flooding that occurred
    during Hurricane Harvey and that a number of equipment failures
    occurred as a result.
        The CSB also indicated that other facilities in flood prone
    areas face similar problems and made recommendations on how to
    address some of these risks.
        I think that many of these recommendations are relevant to
    CFATS facilities. Do you believe that the damage extreme
    weather causes facilities covered by CFATS is a serious threat
    to the safety of surrounding communities?
        Mr. Wulf. I think, certainly, natural hazards are just that
    and we have certainly seen them impact chemical facilities.
        Ms. Matsui. OK. Do you think a CFATS security plan should
    consider the threat of severe weather and help protect facility
    worker and communities? Why or why not?
        Mr. Wulf. So I think it's important that CFATS be able to
    stay focused on security. It is a security-focused anti-
    terrorism program.
        But I will note that there is a lot about the CFATS program
    and about security measures that are put into place or that are
    required to be put in place at CFATS-covered facilities that
    has a positive impact in addressing the facilities' resilience
    in the face of natural disasters.
        So, we require facilities to develop response plans, to
    conduct training, to conduct exercise, to conduct exercises to
    make contact with their local first responders and all of those
    things are equally important in both the terrorism context, in
    the deliberate manmade attack context, as well as in the
    natural disaster context and we have seen it play out in
    instances in which, for instance, a tornado hit a CFATS-covered
    facility in Illinois and it was very well prepared.
        Ms. Matsui. So you're really preparing--in essence, to
    really coordinate these activities more in the sense of part of
    the program to review how to do this so, in a sense, it's part
    of the program?
        Mr. Wulf. I don't believe it makes sense to make it a
    formal part of the program. I think it's important that we
    retain our focus on security. But, again, I think their
    security and safety are very much complementary.
        There are agencies that focus squarely on the safety issues
    on those hazards. We work very closely with the likes of EPA,
    OSHA, with our friends at FEMA, within the Department of
    Homeland Security.
        So I think as a Federal Government community we are very
    much committed to that.
        Ms. Matsui. OK. Thank you very much.
        I yield back.
        Mr. McKinley. Thank you. And now the chair recognizes the
    chairman of the full committee, the gentleman from Oregon, Mr.
    Walden, 5 minutes.
        Mr. Walden. Thank you very much, Mr. Chairman, and thanks
    to you for holding this hearing and, Mr. Wulf, thank you for
    being here. We appreciate your guidance.
        I just have a couple of questions. You've been with the
    program a long time--I won't say a very long time--a long time,
    and, frankly, many people credit your leadership and your
    committed staff with the gains the program has made in recent
    years. So, we go through this with different agencies and,
    frankly, depending on who's in charge doesn't seem to matter
    sometimes who's in the White House.
        So this isn't a partisan issue because we have seen it in
    other agencies. But having seen how a less committed senior
    political leadership can wreak havoc on a program, how do we
    know these reforms are permanent?
        Mr. Wulf. Thank you. Thank you, Mr. Chairman. I appreciate
    very much the kind words. We have a great team in place within
    our program and great buy-in and commitment across our industry
    stakeholder community. So it's very much a team effort.
        I can tell you that our new senior political leadership
    with the change of administration is very, very committed to
    the future of CFATS. It remains a priority with this
    administration, very focused on ensuring that we are able to
    maintain positive momentum that we have the resources we need
    to do just that.
        So, we remain focused like a laser beam. I've seen nothing
    but support from the upper reaches of the department and the
    administration.
        Mr. Walden. Right. And some of the witnesses on the second
    panel in their testimony today on CFATS that they say that
    CFATS has made serious improvements in problems it was facing 4
    years ago.
        What do you attribute the progress of CFATS program over
    the course of the last 4 years?
        Mr. Wulf. I appreciate that question.
        I think, first and foremost, I attribute the progress we
    have been able to make to the environment of stability that has
    been fostered by long-term authorization on which this
    committee showed so much leadership in 2014.
        So that gave us the stability that we needed to plan for
    and execute many of the improvements I've detailed here today.
    It afforded our industry stakeholders the certainty they
    deserved as they were thinking through making significant
    investments in CFATS-focused security measures.
        I would say also I would credit a lot of the progress to
    the spirit of openness and transparency which we have strived
    to operate over the past 4 years.
        So, we have a very strong relationship with our industry
    stakeholders. We take their feedback very seriously. We involve
    them in efforts to improve the program. We very much value
    their input.
        And, thirdly, I would point maybe to a willingness to
    change processes--to not stick with the status quo to do game
    changing things like take a corporate approach to inspection
    activity, to take a fresh look at our suite of online tools and
    see what we can do about making them more user friendly, more
    streamlined, and more useful in the development of top-screen
    risk assessment surveys and site security plans.
        So all of the above but at its core, the stability of that
    long-term authorization has been absolutely key.
        Mr. Walden. Well, and as chairman of the full committee,
    you have my assurance that we are going to move expeditiously
    to reauthorize this work.
        Mr. Wulf. We appreciate that.
        Mr. Walden. We know of its critical importance. You keep
    this up, you may get cloned and your staff too because not
    every program and agency achieves these kinds of results.
        So we do appreciate your leadership and that of your team
    and you look forward to working with you so we meet our
    deadlines here and get this reauthorized.
        So with that, Mr. Chairman, I'd yield back.
        Mr. McKinley. Thank you very much.
        The chair recognizes Ms. DeGette from Colorado for 5
    minutes.
        Ms. DeGette. Thank you, Mr. Chairman.
        Thank you for coming today, Mr. Wulf. Right on the border
    of my district is the Suncour oil refinery.
        There are 53,000 people that live within a 3-mile radius of
    that refinery and that includes over 5,000 children under 5
    years old who are particularly susceptible to air toxins.
        The neighborhood that's the closest to the refinery,
    Elyria-Swansea, has a population that's over 80 percent Latino
    with over 25 percent of the residents living with incomes below
    the poverty line, and as you know, these characteristics are
    pretty common for neighborhoods that are nearby industrial
    facilities.
        So I wanted to ask you would you agree that while security
    is important for all chemical facilities, additional
    considerations like mitigation are necessary when you're
    dealing with urban facilities with large populations right
    nearby. Security is not the only issue that these institutions
    or that these refineries and others are facing.
        Mr. Wulf. Well, sure. Yes. Absolutely.
        Ms. DeGette. And one thing that happened over at Suncour we
    have had problems with interruptions from the external power
    supply and, as you know, even brief disruptions to the power
    supply can cause harmful chemical emissions.
        In October 2016, the Suncour refinery suffered an
    accidental power failure that led to release of a yellow cloud
    of smoke, which closed the highway and caused 14 local schools
    to go into lockdown.
        And then they had a second power outage in March 2017 which
    released more than 500 pounds of sulfur dioxide gas and a
    hundred pounds of hydrogen sulfide gas.
        So my question is--I know, you look a little puzzled
    because--but I am wanting to know is power supply security a
    consideration when the Department of Homeland Security
    considers site security plans submitted by high-risk
    facilities?
        Mr. Wulf. So, yes, the power supply is certainly something
    that----
        Ms. DeGette. Is one of the things?
        Mr. Wulf [continuing]. Something to be considered and also
    considering what contingencies are in place it is certainly
    important from a security perspective when the power goes out.
        Ms. DeGette. OK. Does DHS have specific recommendations for
    providing a secure power supply under CFATS?
        Mr. Wulf. I will get back to you on that, certainly.
        Ms. DeGette. Thank you. OK. Now, DHS is not allowed to
    disapprove of the site security plan because it lacks specific
    security measures. Is that right?
        Mr. Wulf. That is correct. It's a nonprescriptive program
    so we work with facilities to assess what makes sense and meets
    the intent of the relevant risk-based performance standards.
        Ms. DeGette. So would you consider a facility secure if it
    suffered a significant chemical release due to a brief power
    outage or would that show that the facility might be
    susceptible to deliberate disruption? Would you look at that?
        Mr. Wulf. It would be something we would look at,
    certainly.
        Ms. DeGette. Now, the CFATS program is intended to protect
    chemical facilities from terrorist attacks. Is that right?
        Mr. Wulf. That is correct, to protect against terrorist
    attack or exploitation. The majority of the facilities we have
    in the program that have been designated at high risk are
    designated as such owing to the threat of theft or diversion of
    chemicals----
        Ms. DeGette. OK.
        Mr. Wulf [continuing]. Being taken offsite and deployed.
        Ms. DeGette. Off site. So the Suncour refinery incidents I
    talked about before caused by accidental power outages they
    would be included in the scope of the program though, right?
        Power outages that are causing chemical releases.
        Mr. Wulf. Yes. The power situation and resilience in the
    face of power, ensuring that the security systems are resilient
    is important.
        Ms. DeGette. Now, what about emissions caused by
    negligence, natural disasters, or other types of actions? That
    would not be included?
        Mr. Wulf. That is not within our purview. But, as I've
    mentioned here, many of the measures that we require to be put
    in place through CFATS such as the conduct of training,
    exercise the development of response plans that are
    applicable----
        Ms. DeGette. They would----
        Mr. Wulf [continuing]. In both the natural disaster context
    or manmade attacks.
        Ms. DeGette. They would have that potential spillover
    effect, right?
        Mr. Wulf. Right. Right. A complementary----
        Ms. DeGette. Yes. But, Mr. Chairman, the reason why I bring
    this up is because security is really important to me but there
    is so many other issues.
        I would hope that we can also come to bipartisan agreement
    on how we address these toxic releases, because in my district
    and many other districts in the country, people are living
    right next to these plants and even if it's not a terrorist
    attack or a natural disaster, they are at risk of contamination
    every day.
        So I would hope that would be another issue that we could
    work on in this committee.
        Thank you, and I yield back.
        Mr. McKinley. Thank you very much, and I hope we can
    continue that dialogue on that.
        Now the chair recognizes from Texas Mr. Olson for 5
    minutes.
        Mr. Olson. I thank the chair, and welcome, Mr. Wulf.
        As you know, I am a congressman from Texas 22. I like to
    call that the suburbs of the energy capital of the entire
    world, the massive petrochemical complex along the Port of
    Houston and Houston ship channel.
        Mr. Wulf. Absolutely.
        Mr. Olson. As you know, there are lots of nasty chemicals
    on our highways and our railroads. In fact, this last month,
    Houston had the anniversary but remembered that--see, was it in
    1976 had a tanker turn over a truck with ammonia.
        Six people died. Over 60 were hospitalized. That was right
    by Interstate 610 U.S. 59, right by the Galleria. I know that's
    not CFATS, but my point is those chemicals are all over our
    roads, and that's just ammonia going by traffic.
        It's been talked about, some of the issues with the Crosby
    fire during Hurricane Harvey. I want to talk about cyber
    attacks, because the bad guys now are adjusting to attack us
    through cyberspace.
        What happened at Crosby was a failure of the backup system.
    They had backup power but they didn't test enough. They fired
    up for maybe a minute or two--hey, it's working. It had to
    work. It didn't. And as you know, the chemical--once you lost
    control of the process it was going to come through and have an
    emission.
        And so terrorists could easily hack into there and open up
    those things, do exactly what nature did. So how is CFATS
    adapting to terror attacks through cyberspace?
        Mr. Wulf. Yes, you're absolutely right. Cyber attacks--very
    significant threat vector. Chemical facilities vary in the
    level to which cyber systems are integrated with their
    industrial control systems, with their process systems, and,
    for that matter, with their security systems.
        But there certainly exists a decent population of
    facilities where those systems are very much integrated and so
    one of our risk-based performance standards--and I think this
    was in place before any folks were thinking about
    cybersecurity--one of the 18 risk-based performance standards
    under CFATS focuses specifically on cybersecurity.
        Mr. Olson. All right. Good.
        Mr. Wulf. So we have trained a large number of our
    inspectors to work with facilities that have the fuller
    integration of cyber systems with their industrial control
    systems.
        We have cyber experts on our staff at headquarters who
    review those facility site security plans and provide guidance
    to the inspectors in the--in the field.
        We ask facilities to put in place sound cybersecurity
    practices or other site security things--a very important part
    of our program.
        Mr. Olson. Thank you. That is music to my ears.
        More of a softball question for you. As you noted, CFATS
    was authorized a little over one decade ago. Looking back,
    could you talk about the single biggest lesson learned that
    you've had the first years of the program? What's one thing
    you've learned over those first couple years?
        Mr. Wulf. So I think the most important thing is that it
    takes a community to secure America's chemical infrastructure--
    that it's not something we can do alone and it's not something
    we can do without the feedback of our industry stakeholders.
        So, the importance of transparency, the importance of
    openness, the importance of a community wide approach. A shared
    commitment to chemical security is absolutely key and I think
    as a result we have seen a great deal of buy-in and a great
    deal of commitment across our community of owners and operators
    of high-risk chemical facilities.
        Mr. Olson. Thank you. That brings up the next question and
    that is domestic community. How about international community?
        As you note in your opening statement, the threats we have
    seen in our homeland have spiked up following terrorist attacks
    overseas.
        NATO and our allies in Europe are dealing with these
    attacks every single day as are allies all across the world.
    Can you discuss how our CFATS program compares with their
    programs and are we exchanging data with NATO, with other
    countries? Are they exchanging with us? Are we working together
    to address this problem?
        Mr. Wulf. That's a great question, and we are prioritizing
    international outreach. So I actually have the privilege of
    chairing a G-7 global partnership working group on chemical
    security.
        We are engaging with our European Union partners and a
    number of other nations to sort of share best practices, to
    compare notes on chemical security.
        I will tell you that what we are doing here is in many,
    many ways the envy of the world--significantly more
    comprehensive.
        There is a large threat out there. We have been relatively
    privileged not to have as many chemical-focused attacks. But no
    question adversaries around the world continue to seek out and
    to use in attacks chemicals of exactly the sort that trigger
    coverage under CFATS.
        So, we need to remain vigilant. There are other approaches
    to securing certain chemicals, in particular, IED precursor
    chemicals. In Europe, that seemed to be making some headway. I
    think we want to learn from our colleagues over there what is
    working as we think through potentially new approaches at the
    point of sale to high threat IED precursor chemicals, whether
    of a voluntary or a regulatory nature and that's probably
    another hearing for another day. But we learn a lot from our
    international colleagues and I think they learn a lot from us.
        Mr. Olson. I thank you. So my time is expired.
        A final closing comment--you always have a standing
    invitation to come to Houston, Texas, see all that stuff with
    your own eyes. Also, enjoy the best barbecue at the Swinging
    Door in Fort Bend County and also the best Mexican breakfast at
    Bob's Taco Station in Rosenberg, Texas.
        Mr. Wulf. OK. What was the first one? I want to make----
        Mr. McKinley. OK.
        Mr. Olson. The Swinging Door. That's in Richmond. Bob's
    Taco Station is in Rosenberg.
        Mr. Wulf. All right. We are down there quite a bit so I
    will----
        Mr. Olson. Yield back.
        [Laughter.]
        Mr. McKinley. Thank you.
        Mr. Olson. Thank you, Chairman.
        Mr. McKinley. The chair now recognizes the very patient
    member from Georgia, Mr. Carter, for his 5 minutes.
        Mr. Carter. Well, it's certainly going to be hard to follow
    that but I'll do my best.
        Thank you, Mr. Wulf, for being here. I appreciate it.
        I want to echo the comments of the chair of the full
    committee. Just from listening to you, it appears that you have
    a firm grasp of this and have a handle on it and I appreciate
    that. That's good to know.
        I wanted to ask you, it appears that improvements have been
    made in the program as it's gone along, and from what I
    understand in some of my reading that since the implementation
    of CFATS the GAO makes a number of recommendations that appear
    to have improved the program, and I just wanted to ask you
    specifically about two things--: vulnerability and economic
    consequences. Those two things are of concern to me and I just
    wanted to ask, have you changed your overview of these two
    things, particularly of economic consequences? Or the
    management of the program--have you tried to address this at
    all?
        Because I believe that GAO had noted that that was one
    thing that was not taken into consideration enough and that was
    the economic consequences.
        Mr. Wulf. That's exactly right. So GAO made a number of
    recommendations related to tiering and we have taken them all
    very much to heart in developing our new and improved risk
    tiering methodology which does take a significantly more
    comprehensive approach to addressing all relevant elements of
    risk to include consequence, vulnerability as well, looking at
    the sort of inherent vulnerabilities associated with facilities
    on a facility by facility basis--things like, how chemicals are
    stored, the types of containers, among many other things, and
    threat.
        With respect to economic consequences, we have studied this
    very hard in response in response to the recommendation and I
    think just makes sense to have done that anyway.
        Our ultimate conclusion was that the threshold, which is
    actually a classified threshold for significant economic
    consequences to the Nation from an attack on a specific
    chemical facility, is a pretty high one.
        And so, it was based on a review of the facilities in our
    program. They were not facilities on which an attack would move
    the needle from a risk tiering perspective with respect to
    economic consequences.
        So it is not included in our tiering methodology right now
    but we have the resources. We have the knowledge from the study
    to include it as needed if we get to a point where economic
    consequences are, potentially, significant enough from one
    attack on a single facility.
        Mr. Carter. Let me ask you just a couple of simple
    questions, if you will. How do you determine who is to comply?
    Is that incumbent upon the business itself or do you determine
    that or what?
        Mr. Wulf. Yes. So the way the process works is that
    facilities that have holdings of one or more of our 320
    chemicals of interest that are in the regulation self-identify
    if they have those chemical holdings at or above the specified
    threshold or at or above the specified concentration.
        They submit to us what we call a top-screen, so basic
    information about the facility, about the chemical holdings,
    and we run that through our risk tiering methodology and make a
    determination as to whether the facility, based on the totality
    of the circumstances of its facility, of its chemical holdings,
    of its location as relevant--whether it's in an urban or rural
    area, whether that facility is at high risk of terrorist attack
    or exploitation, and if it is--and about 10 percent of the
    facilities that submit this paperwork to us ultimately are
    determined to be high risk--if a facility is issued that
    determination we then issue it a risk tier.
        So it's placed in one of our four risk tiers and then
    embarks upon the process of collaborating with us as it
    develops a site security plan that's ultimately approved and
    then entering into the regular cycle of compliance----
        Mr. Carter. So it is incumbent upon the business to
    initiate it?
        Mr. Wulf. It is.
        Mr. Carter. OK.
        Mr. Wulf. But we prioritize getting the word out about
    those reporting obligations because the community of those who
    hold chemicals is very diverse.
        Mr. Carter. I see. Right.
        Mr. Wulf. So it's not only the traditional chemical
    manufacturers.
        Mr. Carter. Well, very quickly, because I want to get this
    in. I have two major seaports in my district.
        That seems like that would be a bugaboo to try to really
    have an overview of that----
        Mr. Wulf. Yes. No, that's----
        Mr. Carter [continuing]. Of everything that's going through
    those ports.
        Mr. Wulf. Yes. There is a lot of chemical infrastructure on
    the water at the ports. Our friends at the Coast Guard have the
    responsibility actually----
        Mr. Carter. OK.
        Mr. Wulf [continuing]. For managing that. So facilities
    that are regulated by the Coast Guard are specifically exempted
    from CFATS.
        Mr. Carter. Right.
        Mr. Wulf. So we work very closely with the Coast Guard.
        Mr. Carter. Good. Thank you very much.
        Mr. Wulf. Absolutely.
        Mr. Carter. And I yield back.
        Mr. McKinley. Thank you very much.
        Now, if I could, you've been going here almost 2-plus hours
    on this thing. But let me just conclude with one question, if I
    could--the privilege of the chair.
        I want to clarify your answer to Congressman Johnson about
    the listing of items on Appendix 1, because I've spoken to
    several chemical manufacturers in our district and they claim
    that on Appendix 1 is this designation of high priority
    chemicals--you understand that. They claim the existing statute
    is silent over whether it's subject to notice in rulemaking
    versus the sole discretion of DHS.
        I thought you said that it had to go through notice in
    rulemaking. I just want for the record you saying it does go
    under----
        Mr. Wulf. Yes. It is part of our regulation and so I have a
    crack team of lawyers who tell me that as a result of its
    status in the regulation it is subject to notice and comment
    rulemaking pursuant to the administrative procedures.
        Mr. McKinley. So these manufacturers maybe are just
    mistaken where they think it's silent?
        Mr. Wulf. Yes. It may not be explicitly addressed in the
    statute but there are other legal frameworks that apply to it.
        Mr. McKinley. OK. Thank you very much. Thank you.
        Mr. Wulf. Absolutely.
        Mr. McKinley. Seeing that there are no further members
    wishing to participate and ask questions, I'd like to thank our
    witness again for being here today.
        And with that, we will end the first panel.
        Mr. Wulf. Thank you so much.
        [Pause.]
        Mr. McKinley. So if we could, we call up the second panel
    now--and your placards.
        [Pause.]
        OK. We want to thank our witnesses for being here today,
    many of you just went through the first panel and so we begin
    the second panel so--and your taking the time to testify before
    this subcommittee.
        Today's witnesses will have the opportunity to give opening
    statements followed by a round of questions from the members
    that are present.
        Our second panel for today's hearing includes Chris Currie,
    Director of the Emergency Management National Preparedness and
    Critical Infrastructure Protection, Homeland Security, and the
    Justice Team in the U.S. Government Accountability Office; Mr.
    Brown, President and CEO of Brown Chemical Company; we also
    have Mike Wilson, National Director for Occupational and
    Environmental Health in BlueGreen Alliance; Mr. Roberts,
    Principal of Chemical Security Group, LLC; and James Conrad,
    the Principal of Conrad Law and Policy Council on behalf of the
    Society of Chemical Manufacturers and Affiliates; and lastly,
    Yvette Arellano, the Policy Research and Grassroots Advocate of
    the Texas Environmental Justice and Advocacy Services.
        So we appreciate you. The subcommittee appreciates all of
    you for being here today and the patience of working with us on
    this, and we will begin the panel discussion with Mr. Currie
    for his opening statement of 5 minutes.

    STATEMENTS OF CHRIS P. CURRIE, DIRECTOR, EMERGENCY MANAGEMENT,
    NATIONAL PREPAREDNESS, AND CRITICAL INFRASTRUCTURE PROTECTION,
          HOMELAND SECURITY AND JUSTICE TEAM, U.S. GOVERNMENT
      ACCOUNTABILITY OFFICE; DOUG BROWN, PRESIDENT AND COO, BROWN
         CHEMICAL COMPANY; DR. MIKE WILSON, NATIONAL DIRECTOR,
      OCCUPATIONAL AND ENVIRONMENTAL HEALTH, BLUEGREEN ALLIANCE;
     STEVE ROBERTS, PRINCIPAL, CHEMICAL SECURITY GROUP, LLC; JAMES
    CONRAD, PRINCIPAL, CONRAD LAW AND POLICY COUNSEL, ON BEHALF OF
       SOCIETY OF CHEMICAL MANUFACTURERS AND AFFILIATES; YVETTE
       ARELLANO, POLICY RESEARCH AND GRASSROOTS ADVOCATE, TEXAS
                ENVIRONMENTAL JUSTICE ADVOCACY SERVICES

                      STATEMENT OF CHRIS P. CURRIE

        Mr. Currie. Thank you, Mr. Chairman, Ranking Member Tonko,
    other members of the committee that are here.
        I think this hearing is really well-timed. CFATS is over 10
    years old. We have spent almost a billion dollars of taxpayer
    money implementing it, getting it up and running, and industry
    has spent its own dollars doing the same thing.
        GAO has been assessing this program for almost a decade,
    and I want to be clear that we have no position on
    reauthorization. That's a decision for Congress.
        Our jobs, as always, is to help you make those decisions
    with information on how well programs like this are working. In
    that regard, it's no secret that this program has had
    challenges.
        Today, after numerous GAO recommendations and heavy
    oversight by Congress, CFATS has addressed many of the
    management challenges it faced early on. I think DHS deserves a
    lot of credit for that. I think Congress deserves a lot of
    credit for the oversight.
        I'd like to summarize just some of our past work and where
    DHS is in addressing the recommendations. First, just
    identifying facilities originally that could have been subject
    to this regulation was daunting and a huge challenge.
        In 2014, we identified, through our own work, chemical
    facilities that were not reporting ammonium nitrate holdings,
    for example, to DHS as they were required to do.
        We recommended the DHS work with EPA, other agencies, and
    states to better share their separate data sources to close
    this gap. Since then, DHS implemented this recommendation and
    identified 1,000 additional facilities that should have
    complied with CFATS.
        Assessing facility risk levels, as was discussed a lot on
    the first panel, and improving site security plans has also
    been a complicated process.
        Specifically, we recommended that DHS improve its process
    for assessing facility risk, or tiering, as was mentioned, and
    have this process peer reviewed, and DHS has taken steps to
    address these issues as well.
        DHS also eliminated the backlog for reviewing and approving
    facility site plans, which at one point we estimated to be 7 to
    9 years long.
        More recently, DHS overhauled and streamlined its tools for
    gathering information from facilities and assessing the risk
    and, according to most industry officials and facilities we
    have talked to so far, the new tool is much easier to use and
    understand.
        As of June 2008, DHS told us they've processed hearing
    results for all but 226 facilities nationwide. Compliance
    inspections are also a critical piece of the program. These
    inspections ensure that facilities are implementing and
    maintaining the security measures in their plans.
        In our 2015 report, at that time DHS had only done 83 of
    these inspections. They recently told us the number is now up
    to over 3,500, and this is promising, but DHS still hasn't
    fully implemented our recommendation to establish a final
    procedure for conducting these inspections.
        They have one in draft that they are using and they tell us
    they expect to finalize that later this year. However, just
    fixing past problems is not enough to declare victory. Now it's
    an important time, I think, to shift our mind set from
    establishing the functional components of a regulatory program
    to questions about what do we expect from CFATS in the future.
        Many of these will be addressed in the report we plan to
    issue next month. First, it's critical that the CFATS program
    be able to measure over time how risk and vulnerability are
    actually being reduced and not just focus on outputs like
    inspection numbers.
        In the past, we have found weakness in how the program
    measures performance and we continue to assess their progress
    in this area.
        Second, the program must evolve and can't be static. New
    security threats such as cyber have to be constantly
    considered. Also, the program is in a unique position to help
    the industry by communicating these threats and best practices.
        Further, a balance must be struck between sharing
    information and protecting security. For example, recently
    deadly incidents show how important it is that first responders
    know what they are responding to at these facilities and how to
    address it.
        We are assessing these and other issues in our ongoing work
    and, as I mentioned, we expect a report out on those specific
    things next month.
        This concludes my statement and I look forward to the
    discussion.
        [The prepared statement of Mr. Currie follows:]
        [GRAPHICS NOT AVAILABLE IN TIFF FORMAT]

        Mr. McKinley. Thank you, Mr. Currie.
        And now the chair recognizes Mr. Brown for his 5 minutes.

                        STATEMENT OF DOUG BROWN

        Mr. Brown. Good morning, Vice Chairman McKinley, and
    Ranking Member Tonko, and members of the subcommittee.
        My name is Doug Brown and I am President and CEO of Brown
    Chemical, a chemical distributor based in Oakland, New Jersey.
    I am also the current chairman of the National Association of
    Chemical Distributors--NACD.
        I thank you for holding this important hearing today on the
    Chemical Facility Anti-Terrorism Standards program and I am
    pleased to provide testimony.
        Brown Chemical was founded in 1936. It is a fourth
    generation family-owned and operated business with 14
    employees. We operate facilities in Oakland and Patterson, New
    Jersey.
        Brown Chemical direct sells, distributes, or packages over
    350 products to approximately 400 customers in 41 states. We've
    been practising NACD's responsible distribution since its
    inception in 1991 when it became mandatory for all association
    members.
        This comprehensive program addresses environmental, health,
    safety, and security risks. Members companies are third-party
    verified to ensure the highest quality of performance in these
    areas.
        While security has always been an inherent element of
    responsible distribution, after the September 11 terrorist
    attacks NACD specifically added security elements to the
    program and the association continues to enhance these
    requirements.
        In 2013, NACD added a specific security code to responsible
    distribution and consolidated many prior requirements and
    improved others.
        Brown Chemical supports a long-term reauthorization of
    CFATS. I believe the CFATS program has made the chemical
    industry in our nation more secure.
        Since the program's establishment in 2007, the industry has
    invested significant capital and training resources for its
    enhanced security measures at our facilities.
        While these investments did not help grow my business, they
    nonetheless ensured the security of my company, our employees,
    and the community.
        It is undeniable there were growing pains in the first few
    years of CFATS. The Department of Homeland Security has worked
    hard to address these issues and has made substantial
    improvements to run the program more efficiently.
        One reason for the success of the CFATS program is the fact
    that DHS has taken the time to truly learn about the diversity
    of the chemical industry and work with companies on security
    measures that meet the CFATS risk-based performance standards.
        DHS has taken a collaborative common sense approach in
    implementing the program while providing flexibility to each
    unique chemical facility in doing so.
        The clear objective of the CFATS program is to help
    facilities be more secure while not taking a punitive approach.
    DHS has excelled in outreach to the industry in three key ways:
    by publishing numerous fact sheets and lessons learned
    documents, by interacting with facility owners and operators
    during the chemical sector security summits and other industry
    meetings, and always making inspectors and headquarters
    personnel available to talk through issues and answer
    questions.
        The 2014 reauthorization of the CFATS program, which, for
    the first time provided CFATS a multi-year authorization,
    further enhanced security efforts by providing regulatory
    certainty to both industry and DHS.
        This stability allowed DHS to increase efficiencies in the
    program while streamlining the information submission process
    for regulated facilities.
        I believe the CFATS program is strong and needs minimal
    change. One priority I can recommend is to require that any
    changes to the Appendix A chemicals of interest list remain
    subject to notice and comment rulemaking.
        Changes to the COI list could have major impacts on my
    business operations and security investments. Changes may be
    needed upon discovery of new threat information. But it is
    important for regulated companies like mine to be able to
    provide information to DHS and explain the impacts of any
    proposed changes.
        I also support the creation of a program under which DHS
    would recognize companies that meet certain criteria such as
    participation and an environmental health, safety, and security
    program like responsible distribution.
        By acknowledging responsible distributors through measures
    like less frequent inspections, DHS would then be able to
    prioritize resources on the noncompliant outliers that may pose
    a greater security risk.
        Brown Chemical supports the CFATS program and looks forward
    to working with the subcommittee on legislation to reauthorize
    this important regulation. A multi-year reauthorization of
    CFATS will provide the certainty needed to enhance the security
    of my chemical facilities and our nation.
        On behalf of Brown Chemical, I appreciate this opportunity
    to present our views on this important issue and I look forward
    to your questions.
        [The prepared statement of Mr. Brown follows:]
        [GRAPHICS NOT AVAILABLE IN TIFF FORMAT]

        Mr. McKinley. Thank you, Mr. Brown.
        And then next on the panel, Mr. Wilson with BlueGreen
    Alliance--your opening statement, please.

                        STATEMENT OF MIKE WILSON

        Mr. Wilson. Thank you, Mr. Chairman, Ranking Member Tonko,
    and distinguished members.
        My name is Michael Wilson. I am the National Director for
    Occupational and Environmental Health at the BlueGreen
    Alliance.
        On behalf of our organization, our national labor and
    environmental partners, and the millions of members and
    supporters they represent, I want to thank you for convening
    the hearing today and for your interest in chemical safety and
    security.
        I am familiar with the risks of industrial hazards because
    I had the privilege of working for 13 years as a professional
    firefighter, paramedic, and EMT, during which time I responded
    to about 10,000 emergency calls.
        I worked in a city with heavy industry centered around
    agriculture, so there were many facilities that used chlorine
    and ammonia and other agricultural chemicals. Responding to an
    incident at one of these facilities meant grappling with a lot
    of uncertainty because the facilities weren't required to
    invite us in and involve us in planning or training for an
    emergency.
        In general, I would say they relied on us if they had an
    emergency but they were reluctant to help us improve the safety
    and effectiveness of our response. Without a doubt, emergency
    response is a necessary aspect of chemical safety and security.
    But it's an indicator of a failure. It's a measure of last
    resort where thoughtful planning and prevention have broken
    down.
        EPA reported this year that most serious chemical accidents
    are preventable if the necessary precautions and actions are
    taken and yet serious industrial chemical accidents continue to
    occur every 2 \1/2\ days across our nation.
        Last year, EPA estimated that about 177 million Americans
    live close enough to an industrial facility to be affected by a
    chemical accident and that these risks fall disproportionately
    on low-income and minority communities.
        CFATS responds to this problem by requiring companies to
    surround dangerous chemicals with security measures and yet, as
    many experts have noted, these measures require continual
    updating to thwart the efforts of a motivated actor. Perhaps it
    is in response to this challenge with security measures that
    thousands of facilities seem to be shifting to prevention
    strategies.
        DHS noted last year that companies reported taking action
    to prevent risks on about 250 dangerous chemicals by replacing
    those chemicals with safer ones, reducing the quantities held
    on site, or switching to less concentrated formulations.
        If DHS is confident in the veracity of these claims, these
    actions do more than manage risks. They actually reduce the
    risk footprint, and in this way they provide protection not
    only from an intentional attack but also from an extreme
    weather event, earthquake, power outage, or mechanical failure
    risks that we've heard from several members today.
        On the other hand, there are about 3,400 facilities that
    have remained in the CFATS high-risk tier and which pose a
    substantial risk to workers and communities.
        Changes to the CFATS program are needed to reward the
    leaders and move the laggards up. CFATS could be strengthened
    with updated requirements in four areas: one, risk management;
    two, risk prevention; three, meaningful participation by rank
    and file worker representatives; and four, emergency response.
        The State of California, the third largest refining state
    in the country, adopted these approaches last year in a
    sweeping new refinery safety regulation, which was motivated by
    a large flammable vapor explosion at the Richmond Chevron
    refinery. That incident created a 100 square meter vapor cloud
    that ignited and endangered the lives of 19 workers and caused
    some 15,000 people downwind of the plant to seek medical
    attention.
        California's comprehensive new regulation is informed by
    the industry's own best engineering and management practices
    developed over the last 20 years and largely shifts from a risk
    management to risk prevention framework. While California is
    improving the safety of refineries in communities, however,
    U.S. EPA is proposing to substantially weaken the Federal
    chemical disaster rule by rolling back most of its key
    provisions, including all 10 of its prevention requirements.
        These changes will endanger the lives of my former co-
    workers in the U.S. Fire Service. They will endanger workers
    and millions of community members and their families who live
    around our nation's chemical facilities. The chemical disaster
    rule should be retained in its original form, not weakened or
    delayed, as the administration has proposed.
        We can and must prevent chemical accidents. I urge you to
    use the reauthorization of CFATS as an opportunity to
    strengthen the program. The results would be fewer explosions,
    fewer injuries and deaths, and a far more resilient industrial
    infrastructure.
        In closing, I would like to thank you again for this
    hearing and for granting me the opportunity to appear, and I
    will be happy to answer any questions.
        Thank you.
        [The prepared statement of Mr. Wilson follows:]
        [GRAPHICS NOT AVAILABLE IN TIFF FORMAT]

        Mr. Harper [presiding]. Thank you, Dr. Wilson.
        The chair will now recognize Mr. Roberts for the purposes
    of an opening statement. You're recognized for 5 minutes.

                       STATEMENT OF STEVE ROBERTS

        Mr. Roberts. Thank you. Good afternoon, Mr. Chairman,
    Ranking Member Tonko, and other distinguished members of the
    subcommittee.
        As a security consultant and lawyer, I've been fortunate to
    participate and work in the CFATS program from the very
    beginning since 2007, more than 11 years ago now, and have seen
    during that time and have participated in dozens of refineries,
    chemical plants, paint and coating manufacturers, agricultural
    facilities, aerospace and defense--a range of CFATS facilities
    that Mr. Wulf spoke about earlier in this testimony.
        Against this backdrop, I am pleased to offer the following
    comments for the committee's consideration: first, reauthorize
    CFATS for multiple years; second, further enhance the
    transparency of the risk tiering process; third, update the
    CFATS rulemaking process; and fourth, ensure that there is
    greater consistency among inspectors and the inspection
    process.
        First, reauthorize CFATS. When the first standalone CFATS
    legislation was introduced 4 years ago, we find ourselves back
    now at the same time, as that legislation nears the end of its
    life. I can certainly say that industry needs the certainty of
    CFATS and reauthorization of CFATS to continue to make its
    investments in the program and continue to implement the
    program. I think DHS also needs the certainty of CFATS to
    ensure its long-term viability of programmatic changes.
        Second, with respect to transparency and risk determination
    process, which we've heard about quite a bit today, ISCD has
    certainly improved the transparency of its risk process. They
    have done many things to help the regulated community
    understand why they may be tiered or not tiered, and includes
    things like webinars, fact sheets, and the like.
        Most significantly--and the agency should get a lot of
    credit--you are willing to call up the agency and have a so-
    called technical consultation, essentially asking why am I
    tiered, is there something that I could do, is there something
    I need to know, is there something that's correct or perhaps
    incorrect in this process. And while often that doesn't change
    the needle, unless there was some kind of error omission, the
    mere process of being able to have that conversation with the
    agency is very helpful and welcome.
        That sort of dialogue was not welcome many years ago at the
    beginning of the CFATS program and I think the current
    leadership has a lot to do with that and should be recognized.
        That's not to suggest that I or the facilities for which I
    work always agree with the process. In fact, many times,
    especially with respect to the most recent CSAT 2.0 resteering
    process, companies have said to me, why am I tiered--can I
    appeal that tiering decision--and the answer is no. The
    regulation does not provide for any kind of appeal mechanism.
        In fact, allowing a straight appeal would probably swallow
    the regulation. DHS would spend all of its time on appeals and
    not being able to articulate and move forward with the program.
    So I don't think a straight appeal would be appropriate.
        But something more formal than a technical consultation but
    something less than a formal appeal would certainly help
    facilities to understand is there something they can do,
    especially on the consequence side of the house, for sites that
    have release flammable or toxic inhalation hazard materials--to
    bring that risk down, re-file a top-screen, and perhaps get a
    different result. Right now, we are not able to effectively do
    that beyond the technical consultation.
        Third, the rulemaking process--as we've noted today, CFATS
    has been around for now 11 years. The regulations have not
    changed one word in that 11-year period, and whether it be
    Appendix A or other key aspects of the rule, in order to change
    that rule, to update it, to align it to certain things, that
    process would need to go through the rulemaking process.
        DHS started that process in the summer of 2014 through an
    advanced notice of proposed rulemaking. But that process has
    now stalled. If we take a look at the current rulemaking agenda
    for the Department of Homeland Security just published
    recently, we now see CFATS has been moved to the list of long-
    term actions.
        I would urge the committee to require that rulemaking occur
    so we can update the program necessarily in very material ways
    that need to occur for both, in my view, industry and for DHS.
        Fourth, as we've heard a little bit and including from Mr.
    Currie, ISCD should opt to make authorization inspections--
    compliance inspections more consistent, more uniform--ensure
    that the same level of knowledge, of rigor, of completeness of
    those processes.
        ISCD has done a lot toward that and I certainly think--and
    have worked with many of these inspectors--they are
    professional, they are courteous, they are very easy going many
    times and friendly.
        However, that does not always translate into the same
    process from site to site, from region to region, even within
    the same region. That inconsistency sometimes and lack of--
    differences in knowledge, understanding the actual tools that
    DHS uses, the CSAT process, the different approaches to how an
    inspection actually occurs--the level of detail or lack
    thereof--is an ongoing source of frustration for many
    businesses, many companies, especially those that operate
    facilities from region to region and very clearly see and
    question why we see so many differences boots on the ground
    among the inspection team.
        DHS has recognized that. We hear from them that they are
    going to take steps and are taking steps, as the GAO has also
    recognized, to improve and enhance that process, going forward.
        But I think more is needed. I think further training is
    needed--minimum standards and better consistency horizontally
    between the regions and vertically between headquarters and the
    regions themselves.
        So with that, I appreciate the opportunity to testify,
    holding this important hearing, and be pleased to answer any
    questions you may have.
        [The prepared statement of Mr. Roberts follows:]
        [GRAPHICS NOT AVAILABLE IN TIFF FORMAT]

        Mr. Harper. Thank you, Mr. Roberts. We appreciate that.
        And Mr. Conrad, we'll now recognize you for 5 minutes for
    the purposes of an opening statement.
        Thank you.
        Mr. Conrad, could you pull that microphone around in front
    of you a little bit? Thank you.

                       STATEMENT OF JAMES CONRAD

        Mr. Conrad. The button. There we go.
        For over a decade, I have been counsel to the Society for
    Chemical Manufacturers and Affiliates, the only U.S.-based
    trade association dedicated solely to the specialty and fine
    chemical industry.
        For the previous 14 years, I was an in-house lawyer at the
    American Chemistry Council and so I've been working on chemical
    facility security since before 9/11 and I've been continuously
    involved in the CFATS process since it was first enacted in
    2006.
        I've also chaired the ABA's administrative law and
    regulatory practice section. I am pleased to be able to provide
    today with SOCMA's perspective on CFATS. CFATS protects high-
    risk chemical facilities and their surrounding communities by
    ensuring that security measures are in place to reduce the risk
    of successful terrorist acts.
        More than half of SOCMA's 115 manufacturing members are
    regulated under the program. We strongly supported and we urge
    Congress to reauthorize the program now before its
    authorization expires this coming January.
        A 1-year reauthorization, however, is not desirable because
    regulatory certainty is crucial to business planning. Complying
    with CFATS is expensive and time consuming, especially for
    small businesses. SOCMA's members want the program to be
    consistent and predictable, and a multi-year reauthorization
    would give them that assurance.
        Through the years, the CFATS program has undergone dramatic
    changes. The early years were a significant challenge for
    everyone, but the program has vastly improved under the
    direction of Deputy Assistant Secretary Wulf, whose earlier
    accomplishments gave Congress the confidence to reauthorize
    CFATS for 4 years in 2014.
        SOCMA believes that the program's continued progress is
    directly attributable to Mr. Wulf's leadership and justifies
    another reauthorization for a comparable period of years.
        The most significant recent improvement in CFATS is Version
    2.0 of the Chemical Security Assessment Tool, or CSAT. The
    original CSAT process was clunky and difficult to use, took
    significant amounts of time and resources to complete.
        The number-one recommendation of SOCMA's CFATS comments in
    2014 was that DHS fix it, and DHS has now done that
    dramatically, and our members uniformly report that it's much
    easier to use and far less resource intensive while still
    giving DHS the information it needs.
        This improvement is extremely important for SOCMA members,
    70 percent of which are small businesses. Most of these
    businesses cannot afford to have dedicated regulatory
    compliance staff nor can they afford to hire consultants to do
    the job for them.
        While I've thus far applauded DHS's efforts, SOCMA does
    have some concerns. It first relates to how DHS tiers or
    assigns risk levels to facilities based on their CSAT
    submissions.
        When Congress reauthorized CFATS, it instructed DHS to
    ``share with the owner or operator of a covered chemical
    facility any information that the owner or operator needs to
    comply with this section.''
        Congress could revise this language to create a clearer
    obligation for DHS to share with the facility the exact reason
    for its tier assignment. That would help them understand how
    they could lower their risk tiers.
        The second concern is the personnel surety program.
    Currently, PSP only applies to tier one and two facilities, but
    DHS is considering applying it to tiers three and four.
        SOCMA believes this is premature. These facilities, by
    definition, pose lower risks and the PSP program continues to
    impose burdens in terms of time and delay.
        SOCMA believes DHS should work with the Department of
    Justice and the FBI to rigorously assess both what risks are
    avoided and what costs are imposed by the process, and we think
    such a multi-agency review is necessary before we expand it
    further.
        We also believe CFATS should recognize voluntary industry
    programs that enhance the safety and security of hazardous
    chemicals and thus complement what the CFATS program does.
        The leading chemical industry trade associations have
    organized and implementing demanding stewardship initiatives
    such as SOCMA's ChemStewards to manage and improve
    environmental health, safety, and security performance--a
    public-private partnership that leveraged these industry
    stewardship programs like ChemStewards to benefit both chemical
    facilities and the public.
        And then last, I will emphasize a point that's been made
    before about the continuing importance to use rulemaking in
    amending Appendix A, and I will agree with Director Wulf.
        Currently, the Administrative Procedure Act requires
    Appendix A to be changed through rulemaking because it's
    already part of the rule, and so that will continue to be the
    case, unless that were to be changed by new legislation, which
    we would not support because it's important for facilities to
    be able to get the information to the DHS that it needs to
    understand them. The bottom line is that CFATS is working and
    working far more successfully and efficiently than a lot of
    other regulatory programs.
        CFATS inspectors generally interact well with facilities
    and the agency has an effective compliance assistance program.
    Facilities are more secure and the public is safer today
    because of this program.
        Congress should reauthorize it to maintain that progress.
        Thank you.
        [The prepared statement of Mr. Conrad follows:]
        [GRAPHICS NOT AVAILABLE IN TIFF FORMAT]

        Mr. Harper. Thank you, Mr. Conrad.
        The chair will now recognize Ms. Arellano for 5 minutes for
    the purposes of an opening statement.
        Welcome.

                      STATEMENT OF YVETTE ARELLANO

        Ms. Arellano. Thank you, Chairs and Ranking Members, of the
    Energy and Commerce Committee and Subcommittee on the
    Environment.
        Thank you for this opportunity to speak on the proposed
    rule to roll back and eliminate critical protections for my
    community in Houston Texas that are part of EPA's 2017 chemical
    disaster rule.
        I am disappointed that the EPA and its rulemaking has
    chosen to only hold one hearing in Washington, D.C., making it
    difficult for voices like those in my community to be heard.
        But I am relieved that I can bring my experience to this
    hearing. My name is Yvette Arellano. I am here on behalf of
    Texas Environmental Justice Advocacy Services.
        We are a nonprofit working to educate and mobilize our
    community in southeast Houston, including Manchester and the
    surrounding neighborhoods, which have high concentrations of
    chemical facilities.
        The EPA is required to regulate effectively under the risk
    management plan and CFATS. This exposes our communities which
    include significant communities of color and low-income
    families to more toxic air, pollution, and disproportionate
    harm from chemical disasters.
        As illustrated too well from Hurricane Harvey, too often we
    experience a toxic flood on top of the threats we already face
    from hurricanes and heavy rains. That comes on top of disparate
    health and safety impacts we already face around the year
    because EPA refuses to do its job to protect us from the
    frequent toxic releases and pollution these facilities send
    across the fence line into our communities.
         At Hartman Park, which is right across the street from the
    Valero refinery, communities painted a mural reflecting that
    nearly every child that plays in the park is in the shadow of a
    nearby chemical facility--a far cry from what people at this
    hearing see out of their window in Capitol Hill and D.C.
        Communities in Manchester never know which incident
    requires evacuation or sheltering in place. We hear the sirens
    go off. I heard the sirens go off, or alarms go off, for a vote
    and that sent my stress levels high.
        People live in constant fear of releases or incidences
    while their children are playing outside. In hurricane seasons,
    it's bad enough that families have to prepare for their lights
    to go out and ensuring that they have enough food and water.
        No one should have to shelter in place due to a hurricane
    as toxic chemicals flood their homes, wondering what to do if
    facilities down the street will have a catastrophic explosion,
    chemical fire, chemical release, as what happened in our
    community and neighborhoods during Harvey. People deserve the
    right to know the information necessary to make informed
    decisions for them and their families.
        The chemical disaster rule contains important safeguards
    that would help communities like mine and across the country
    with common sense provisions, most importantly, for our already
    over exposed communities.
        We need this fully effective right now and we need to
    require facilities to take action to prevent fires, explosions,
    and disasters including by ensuring they actually look for
    safer ways to operate before a disaster starts. It also would
    have increased the availability of basic information we need to
    know, like chemical safety data sheets and emergency response
    contacts so communities can try to find ways to protect
    ourselves if a serious incident happens.
        Community members should get the information from each
    incident they're exposed to without delay and it's essential
    for facilities to do real incident investigation reports that
    they cannot ignore in planning to prevent future problems.
        I want to highlight that the rule finalized in early 2019
    and came afterward by the EPA and after over a hundred groups
    working with TEJAS called for action, starting in 2011, as
    disasters were happening across the country and people in
    Washington, D.C. didn't seem to pay attention.
        It also provided for a better coordination through sharing
    information first responders need and assuring practice
    notification and exercises happen to prepare without delay.
        EPA cannot justify repealing all of the prevention and
    weakening other important requirements and it has refused to
    face the fact that it's taking away protections meant to save
    lives and prevent harm, especially to communities like ours,
    right across the fence line from chemical facilities.
        These rollbacks don't come without community costs as
    fires, toxic releases across the country on this
    administration's watch, especially the Arkema explosion in
    Crosby after Hurricane Harvey, demonstrated.
        A lack of information puts the surrounding community and
    first responders in jeopardy. First responders on the scene had
    to be evacuated and received medical treatment for inhaling
    dangerous chemicals from the blast.
        Community members are still dealing with the aftermath of
    chemical debris which is visible on their lawns and cars. The
    Valero refinery and other nearby facilities released a spike of
    benzene and other toxic chemicals. But most of these were
    missed because EPA and states turned off or moved most of the
    air monitors.
        I urge this committee to consider the impacts on your
    neighbors, on our neighbors, our families, without critical
    protections like those in the chemical disaster rule and ask
    you to call on President Trump and the administration and
    Administrator Pruitt to drop the hazardous plan that the EPA is
    considering which would revoke lifesaving protections for
    communities across the country, preventing children and
    vulnerable communities from chemical disasters.
        The way EPA originally found was necessary should not be a
    partisan issue and we call on Congress and EPA to protect
    communities, not chemical companies.
        Communities across the country remain in harm's way and
    this is especially scary as we drive around Houston with
    billboards saying hurricane season has begun--be prepared.
        [The prepared statement of Ms. Arellano follows:]
        [GRAPHICS NOT AVAILABLE IN TIFF FORMAT]

        Mr. Harper. Your time has expired. I apologize.
        We'll give you opportunity during the questioning. Thank
    you very much.
        It's now time for the members to ask questions. I want to
    thank each of you for your appearance here and for your insight
    and the experience that you bring.
        And Mr. Roberts, I would like to ask you a question first.
    We've from GAO that one of the challenges faced by DHS with the
    implementation of CFATS is compliance enforcement.
        Your written testimony points out that there's
    inconsistency with inspections and enforcement from region to
    region. Can you elaborate some on that and perhaps give us some
    suggestions on how to correct that?
        Mr. Roberts. Certainly. Let me emphasize again the
    inspectors are, almost without fail, are extremely helpful.
        They're friendly, professional, but there continues to be a
    lack of, it seems, consistent knowledge in various areas of the
    program, including the specific way the regulation itself may
    work--the confusion oftentimes between what regulation is and
    implementing guidance.
        As we know, CFATS is a risk-based performance standard.
    That means that DHS can't prescribe the particularly security
    measure a facility must implement or may not--or does not need
    to implement for plan approval, and we've had many instances
    over the years, especially as DHS has upticked, obviously, it's
    compliance inspections in the last few years where the specific
    manner and nature of those inspections simply is not the same
    region to region and even within the same region.
        Some of that may go back to training. Some of it may go
    back to the prior biases or lack thereof of the inspector who
    may come from a prior Federal background.
        Some of that goes to, on a positive side, with familiarity
    of an inspector with the site so they may not feel the need to
    continue to go very deeply sometimes.
        But the way a particular inspector assesses things seems to
    lack any real consistency from site to site, region to region.
        Mr. Harper. And I appreciate the way you have elaborated on
    that. So is this a training issue that we are talking about or
    is it just something that, because of the different
    experiences, we can't correct?
        Mr. Roberts. No, I think it absolutely is a couple of
    things. One is training around the actual rule--training around
    the CSAT portal--how it works.
        We've had instances where inspectors would ask a facility
    to do something in their top-screen that is not possible
    because the top-screen doesn't allow that type of data to be
    inputted. So that just shows me that that particular inspector
    may not understand how the top-screen itself works.
        Certainly, training of the regulation--the top-screen tool,
    the CSAT suite of tools that Mr. Wulf mentioned--certainly, the
    guidance--difference between guidance and regulation, and I
    think, as DHS has indicated, as GAO has indicated, as DHS has
    said in other occasions, they are putting together some more
    specific directives, some more specific guidance material for
    their inspectors.
        I think this is one area where actually a checklist would
    be helpful in terms of understanding what an inspection should
    do, what we should look for, the level and detail an inspection
    should occur, site to site, region to region, regardless of the
    particular nuances of the facility. There are some basic things
    that should occur every time.
        Mr. Harper. Thanks, Mr. Roberts.
        Mr. Conrad, if I may ask you--I know we've had some that
    would argue that information from CFATS-regulated facilities is
    not available to people who should know it. What would be your
    response to that?
        Mr. Conrad. I would say that if that's true it's because
    the systems we have in place to make that happen aren't
    working. There is a statute, the EPCRA--the Environmental--the
    Emergency Planning and Community Right to Know Act--that
    originated in this committee whose sole focus is to make sure
    that state and local emergency planning bodies and fire
    departments are provided with all the information that they
    need to plan for emergencies of whatever sort--natural as well
    as security related--and to be able to respond to them, and the
    statute couldn't be clearer that, for example, those facilities
    shall promptly provide information necessary for developing and
    implementing the emergency plan.
        So it's not qualified, and it requires submission of lists
    of safety data sheets or the safety data sheets themselves,
    inventories of chemicals, or, upon request, the maximum and
    average amounts of a chemical on the site, where it's stored,
    how it's stored, and that information, in turn, can be made
    available to the public.
        And specifically with respect to fire departments, it says
    that the owner or operator with the facility shall allow the
    fire department to conduct an on-site inspection of the
    facility and shall provide to the fire department specific
    location information on hazardous chemicals at the facility.
        So we think the statute is sound. It may well be
    appropriate for this committee to conduct oversight on why it
    is the LEPAS perform more or less well in certain areas. But
    the CFATS program doesn't restrict any of that.
        To the contrary, the statute that you all passed 4 years
    ago expressly preserves all those sorts of information
    disclosure statutes from any effect by a result of the CFATS
    program.
        In fact, this is the CVI guidance from DHS from the Bush
    administration, no less, state--note, state, local, and tribal
    officials including first responders must have access to any
    information that is necessary to plan for and respond to an
    emergency event at a chemical facility.
        It's equally important that this information is available
    in a form that is readily accessible and easily disseminated.
    In most cases, a facility can provide this information that
    contains all necessary operational and facility-specific
    information and excludes CVI.
        But then, as Mr. Wulf said, there's a way for sharing CVI,
    too. So the systems that--the legal system, I think, is sound.
    It's just a question of whether it's really working well.
        Mr. Harper. Thank you very much, Mr. Conrad.
        The chair will now recognize the gentleman from New York,
    Mr. Tonko, the ranking member of the subcommittee.
        Mr. Tonko.
        Mr. Tonko. Thank you, Mr. Chair.
        I believe we must acknowledge that the CFATS program is not
    comprehensive and that security gaps do indeed exist.
        Director Currie, can you give us a sense of the quality of
    information given to first responders near CFATS facilities?
        Mr. Currie. Yes, sir.
        So actually in our ongoing review that we'll issue a report
    on next month we are looking at that very issue and it relates
    to what Mr. Conrad is saying.
        He's right that there's never been an assessment of the
    process itself under CFATS for how well they're coordinating
    with the local emergency planning committees and what they're
    providing.
        That's exactly what we are looking at. We are digging into
    that process to figure out how they're coordinating with those
    committees and what information specifically those committees
    and first responders are actually getting.
        And so, we'll report on that next month.
        Mr. Tonko. You will share that with this committee?
        Mr. Currie. Yes, sir.
        Mr. Tonko. The subcommittee, please.
        Have they always had all the information in preparation
    necessary to respond to incidents at these facilities?
        Mr. Currie. Well, I think one of the things we are looking
    at, as we've talked about today, the CFATS program has only
    been around 10 years and some of these other programs have been
    around much longer.
        So, in the early stages of the program that was not the
    focus. The focus was getting facilities enrolled and things
    like that.
        So, this is something that's evolved over time. Nobody's
    really looked at it, and so that's why we are taking a look at
    it.
        It's an extremely important issue. These are life and death
    situations and it's important they have the information they
    need to respond.
        Mr. Tonko. Thank you. If first responders do not have all
    the necessary information, it makes those security gaps even
    worse.
        Dr. Wilson, what is your sense on some of the security gaps
    in the CFATS program? Do you have any thoughts on the
    exemptions that exist in the program?
        Mr. Wilson. Sure. I think with regard to exemptions, we
    heard earlier around waste treatment nuclear and maritime, and
    I think it's worth assessing whether and to what extent
    security is an element of the safety programs in those sectors.
        And the reason I say that is that in practice, I think
    there's a cultural and operational divide between safety
    engineering and security provisions and yet security and
    engineering are interrelated. So good engineering design drives
    down both safety and security risks but security is often
    missing from engineering practice.
        So last month, the American Institute of Chemical Engineers
    had its conference with a keynote address by the FBI, and the
    reason for that appearance by FBI was to encourage engineers to
    include security in their scope of practice rather than
    relegating it, in a way, to traditional barriers, monitoring,
    and response approaches.
        And so I think it would be worth evaluating if these
    exempted sectors are meeting the CFATS 18 performance standards
    and if they're effectively integrating security into
    engineering practice.
        Mr. Tonko. So, from that, I can assume that first
    responders often--that they may not know exactly what is at a
    facility before having to respond to the incident?
        Mr. Wilson. I would say it's a perennial problem. Despite
    the requirements of the Emergency Planning Community Right to
    Know Act, there are gaps in information, in particular in
    transmitting information to first responders.
        One of the problems with the local emergency planning
    committee structure is that the members of those committees are
    serving voluntarily and yet there is a lot asked of those
    members.
        I served as the state's representative--the state
    Department of Industrial Relations representative--to our state
    emergency response committee in California and saw firsthand
    the difficulty that those members of the local committees--the
    challenges that they carried in trying to implement the
    requirements of a EPCRA and transmitting information
    effectively and so forth.
        Mr. Tonko. I have concerns with EPA's recent decisions
    around the RMP rule. Can you discuss some of the provisions
    that were delayed and what would be rolled back from the latest
    RMP proposal?
        Mr. Wilson. There are 10 provisions having to do with
    incident prevention that are being proposed for removal from
    the program, and we could go through and catalog each of those.
        They are, I think, the most fundamental and most sort of
    protective aspects of the RMP that have been proposed.
        And as I said earlier, one of the reasons I am very
    concerned about that is because of the fact that prevention
    elements provide protection against multiple threats, and we've
    heard from many members today about not only the threat of an
    intentional attack against a facility but the very real threat
    of a natural disaster, of an earthquake--as we are in
    California--of a mechanical failure, and we heard of power
    outage and so forth.
        And so prevention elements or prevention requirements drive
    down that risk footprint in the face of all of those threats.
    Those are proposed to be thoroughly removed under the RMP
    proposal that we are hearing from the administration.
        Mr. Tonko. Thank you, Dr. Wilson.
        With that, I yield back.
        Mr. Harper. The gentleman yields back.
        The chair will now recognize the gentleman from Texas, Mr.
    Green, for 5 minutes.
        Mr. Green. Thank you, Mr. Chairman. I want to thank our
    panel for being here today.
        As I said earlier in our first witness, CFATS was created
    because of what happened in West Texas. But as we found out
    that--and I think the last thing I heard that that was arson
    and still being investigated--but our real challenge is from
    natural disasters, like you just said--earthquakes in
    California, hurricanes and tropical storms in the Gulf of
    Mexico. That's what I would like to focus more on and see how
    we can correct it.
        I have a district in East Harris County, and Ms. Arellano
    is very correct--Manchester has a chemical plant on the west
    side, a thank farm on the north side before the Houston ship
    channel, and a refinery to the east side, and on the south
    they're covered by railroad tracks.
        And that's where Houston literally started back in the
    1830s and 1840s. The Manchester area was actually called
    Harrisburg before there was a city of Houston.
        And so we see a lot of these challenges in urban areas
    where industry is literally right next door to people who have
    lived there and it's in Manchester for 50 years. I know two
    generations at least in that community.
        One of the concerns I had was that during our Hurricane
    Harvey--and I guess I should understand that when it was coming
    in, our air monitors were shut down.
        I've been told that I have probably the most air monitored
    district in the country because we have EPA. We have the city
    of Houston there they have jurisdiction. We have the county of
    Harris with a pollution control agency and, of course, the
    State of Texas, and it's not just the air monitors but the
    other issue is that most of the rising water was literally on
    the bottom of those plants and refineries and chemical plants
    because of the 55 inches of rain in four days--how can you do
    it?
        The other problem, though--and I hope the industry is
    listening because we've talked about it--is that we have huge
    tanks that hold product, either crude oil or refined product,
    and the way they're filled up is that they have floating roofs.
        The problem is when you get that much water on that roof,
    those rooves actually turn and you end up--whatever the
    emissions come from that, but it also can overflow because of
    the heavy rain.
        So we've got a lot of challenges in our area and to keep
    working with it, but we used to have community groups, and I
    hardly hear about them anymore--Manchester, Pasadena, Bay
    Town--the community groups, and I would go to those meetings
    sometimes and the industry would come in and sit down with
    their neighbors along the fence line, and I am not so sure
    those are still going. Is that still active in other parts of
    the country and maybe not in our area?
        Mr. Wilson. Is that question to me?
        Mr. Green. Yes.
        Mr. Wilson. I am not aware of those kinds of meetings
    taking place but I absolutely agree with your characterization
    of the problem.
        One of the things that California has done in its refinery
    safety regulations has required companies to look at inherently
    safer technologies wherever feasible and it has also required,
    and I think in the example that you have just given, risk
    management strategies that require redundancy and independence
    of safeguards to prevent a cascade of failures so, for example,
    in the event of a power failure, losing safeguards, one after
    the other.
        And of course, California is the third largest refining
    state and is, you know, producing jet fuel and gasoline. It's
    inherently hazardous, and so we felt it was important to be
    very clear about the importance of introducing and requiring,
    actually, independence and----
        Mr. Green. I only have 26 seconds.
        Mr. Wilson. Sorry.
        Mr. Green. And I agree, because even with the Arkema
    problem--wasn't in our district but the redundancies weren't
    there. In fact, our Harris County district attorney has
    launched an investigation into that plant and see why it
    didn't.
        Ms. Arellano, in your testimony, you talked a lot about how
    communities like ours in Houston face additional challenges
    during natural disasters due to their proximity to these
    plants.
        What recommendations would you do for industry to improve
    their relationship with community groups and civic clubs,
    because I visit Manchester civic club as often as I can and,
    typically, one of our refinery staff is there to answer
    questions.
        What are some of the suggestions TEJAS would tell us that
    we could do and inform people in the neighborhood but also,
    just how we can do this better? Because those refineries and
    chemical plants are probably not going to move because they've
    been there for 50 years.
        Ms. Arellano. These industry partners, they do come out to
    the civic associations. But they talk about scholarships. They
    talk about fire, indoor air pollutants. They'll hand out fire
    detectors.
        But they won't talk about the latest expansion. They won't
    talk about a permit notice they had out--like the one they have
    out that would increase hydrogen cyanide from 52 tons to 512
    tons.
        They'll go ahead and they'll speak about a backpack
    giveaway event but not give any real information. So I would
    say having true and real information going between industry
    partners and neighboring communities is vital to this process.
        The other thing that I would like people to consider is a
    cumulative analysis of the TCQ is supposed to have some sort of
    cumulative analysis program.
        It's important for us to know exactly the impacts of all
    the neighbors. Just like you said, there is Contanda Chemical,
    it's 87 CO carbon storage tanks with a capacity of a thousand
    to 74,000 barrels of chemical product. At Valero Refining, it
    has 164,000 barrels per calendar day of refining, and then the
    sulfuric acid plant that's Eco Services, original Rhodia.
        So it's important for us to know the impacts of all of
    these aggregated together. RMP facilities have these radiuses.
        But we are not accounting for the toxic impacts on the
    communities, and adding all that information, to not say that
    four facilities are exposing the community to 10 cancer-causing
    substances but instead saying this community is exposed to 40,
    and taking into account that all of them have safety hazards
    and all of them have chemical releases, they all are exposed to
    fires and incidences whether it is--people keep talking about
    these terrorist attacks but the communities are exposed to
    daily toxics.
        They're more frequently exposed to fires from chemical
    releases and fugitive emissions than they are a terror attack.
        So I would hope that this committee considers these
    everyday problems with community members in the decision to
    keep going forward and give people the opportunity to make
    their own decisions--safe ones for them and their families.
        Mr. Harper. The gentleman's time has expired.
        Seeing that there are no further members wishing to ask
    questions, I want to thank each of you for being here today and
    for the knowledge and information that you have shared with us.
    It's very, very helpful.
        Before we conclude, I would like to ask for unanimous
    consent to submit the following document for the record--a
    letter from the Chemical Facility Anti-Terrorism Standards
    Coalition.
        Without objection, so ordered.
        [The information appears at the conclusion of the hearing]
        Mr. Harper. And pursuant to committee rules, I remind
    members that they have 10 business days to submit additional
    questions for the record, and should you get any of those
    questions I would ask that you submit your responses within 10
    business days from the receipt of such questions.
        Without objection, the subcommittee is adjourned.
        [Whereupon, at 12:44 p.m., the committee was adjourned.]
        [Material submitted for inclusion in the record follows:]
        [GRAPHICS NOT AVAILABLE IN TIFF FORMAT]

                                     [all]