[House Hearing, 115 Congress]
[From the U.S. Government Publishing Office]


  THE CHEMICAL FACILITIES ANTI-TERRORISM STANDARDS PROGRAM (CFATS)_A 
                            PROGRESS REPORT

=======================================================================

                                HEARING

                               BEFORE THE

                      SUBCOMMITTEE ON ENVIRONMENT

                                 OF THE

                    COMMITTEE ON ENERGY AND COMMERCE
                        HOUSE OF REPRESENTATIVES

                     ONE HUNDRED FIFTEENTH CONGRESS

                             SECOND SESSION

                               __________

                             JUNE 14, 2018

                               __________

                           Serial No. 115-138
                           
                           
[GRAPHIC NOT AVAILABLE IN TIFF FORMAT]                          


      Printed for the use of the Committee on Energy and Commerce

                        energycommerce.house.gov
                        
                        
                               __________
                               

                    U.S. GOVERNMENT PUBLISHING OFFICE                    
34-591                      WASHINGTON : 2019                     
          
-----------------------------------------------------------------------------------
For sale by the Superintendent of Documents, U.S. Government Publishing Office, 
http://bookstore.gpo.gov. For more information, contact the GPO Customer Contact Center,
U.S. Government Publishing Office. Phone 202-512-1800, or 866-512-1800 (toll-free).E-mail, 
[email protected].                                       
                    
                    
                    
                    
                    
                    COMMITTEE ON ENERGY AND COMMERCE

                          GREG WALDEN, Oregon
                                 Chairman
JOE BARTON, Texas                    FRANK PALLONE, Jr., New Jersey
  Vice Chairman                        Ranking Member
FRED UPTON, Michigan                 BOBBY L. RUSH, Illinois
JOHN SHIMKUS, Illinois               ANNA G. ESHOO, California
MICHAEL C. BURGESS, Texas            ELIOT L. ENGEL, New York
MARSHA BLACKBURN, Tennessee          GENE GREEN, Texas
STEVE SCALISE, Louisiana             DIANA DeGETTE, Colorado
ROBERT E. LATTA, Ohio                MICHAEL F. DOYLE, Pennsylvania
CATHY McMORRIS RODGERS, Washington   JANICE D. SCHAKOWSKY, Illinois
GREGG HARPER, Mississippi            G.K. BUTTERFIELD, North Carolina
LEONARD LANCE, New Jersey            DORIS O. MATSUI, California
BRETT GUTHRIE, Kentucky              KATHY CASTOR, Florida
PETE OLSON, Texas                    JOHN P. SARBANES, Maryland
DAVID B. McKINLEY, West Virginia     JERRY McNERNEY, California
ADAM KINZINGER, Illinois             PETER WELCH, Vermont
H. MORGAN GRIFFITH, Virginia         BEN RAY LUJAN, New Mexico
GUS M. BILIRAKIS, Florida            PAUL TONKO, New York
BILL JOHNSON, Ohio                   YVETTE D. CLARKE, New York
BILLY LONG, Missouri                 DAVID LOEBSACK, Iowa
LARRY BUCSHON, Indiana               KURT SCHRADER, Oregon
BILL FLORES, Texas                   JOSEPH P. KENNEDY, III, 
SUSAN W. BROOKS, Indiana                 Massachusetts
MARKWAYNE MULLIN, Oklahoma           TONY CARDENAS, CaliforniaL RUIZ, 
RICHARD HUDSON, North Carolina           California
CHRIS COLLINS, New York              SCOTT H. PETERS, California
KEVIN CRAMER, North Dakota           DEBBIE DINGELL, Michigan
TIM WALBERG, Michigan
MIMI WALTERS, California
RYAN A. COSTELLO, Pennsylvania
EARL L. ``BUDDY'' CARTER, Georgia
JEFF DUNCAN, South Carolina


                      Subcommittee on Environment

                         JOHN SHIMKUS, Illinois
                                 Chairman
DAVID B. McKINLEY, West Virginia     PAUL TONKO, New York
  Vice Chairman                        Ranking Member
JOE BARTON, Texas                    RAUL RUIZ, California
TIM MURPHY, Pennsylvania             SCOTT H. PETERS, California
MARSHA BLACKBURN, Tennessee          GENE GREEN, Texas
GREGG HARPER, Mississippi            DIANA DeGETTE, Colorado
PETE OLSON, Texas                    JERRY McNERNEY, California
BILL JOHNSON, Ohio                   TONY CARDENAS, California
BILL FLORES, Texas                   DEBBIE DINGELL, Michigan
RICHARD HUDSON, North Carolina       DORIS O. MATSUI, California
KEVIN CRAMER, North Dakota           FRANK PALLONE, Jr., New Jersey (ex 
TIM WALBERG, Michigan                    officio)
EARL L. ``BUDDY'' CARTER, Georgia
JEFF DUNCAN, South Carolina
GREG WALDEN, Oregon (ex officio)
  
                             C O N T E N T S

                              ----------                              
                                                                   Page
Hon. John Shimkus, a Representative in Congress from the State of 
  Illinois, opening statement....................................     1
    Prepared statement...........................................     3
Hon. Paul Tonko, a Representative in Congress from the State of 
  New York, opening statement....................................     4
Hon. Frank Pallone, Jr., a Representative in Congress from the 
  State of New Jersey, opening statement.........................     5
Hon. Greg Walden, a Representative in Congress from the State of 
  Oregon prepared statement......................................     7

                               Witnesses

Dave Wulf, Acting Deputy Assistant Secretary, Infrastructure 
  Protection, U.S. Department of Homeland Security...............     8
    Prepared statement...........................................    11
    Answers to submitted questions...............................   121
Chris P. Currie, Director, Emergency Management, National 
  Preparedness, and Critical Infrastructure Protection, Homeland 
  Security and Justice Team, U.S. Government Accountability 
  Office.........................................................    50
    Prepared statement...........................................    52
    Answers to submitted questions...............................   137
Doug Brown, President and COO, Brown Chemical Company............    68
    Prepared statement...........................................    70
    Answers to submitted questions...............................   146
Mike Wilson, National Director, Occupational And Environmental 
  Health, Bluegreen Alliance.....................................    75
    Prepared statement...........................................    77
    Answers to submitted questions...............................   152
Steve Roberts, Principal, Chemical Security Group, LLC...........    88
    Prepared statement...........................................    90
    Answers to submitted questions...............................   178
James Conrad, Principal, Conrad Law and Policy Counsel, on Behalf 
  of Society of Chemical Manufacturers and Affiliates............   100
    Prepared statement...........................................   102
    Answers to submitted questions...............................   187
Vette Arellano, Policy Research and Grassroots Advocate, Texas 
  Environmental Justice Advocacy Services........................   107
    Prepared statement...........................................   110

                           Submitted Material

Statement of the Chemical Facility Anti-Terrorism Standards 
  Coalition......................................................   119

 
  THE CHEMICAL FACILITIES ANTI-TERRORISM STANDARDS PROGRAM (CFATS)--A 
                            PROGRESS REPORT

                              ----------                              


                        THURSDAY, JUNE 14, 2018

                  House of Representatives,
                       Subcommittee on Environment,
                           Committee on Energy and Commerce
                                                    Washington, DC.
    The subcommittee met, pursuant to call, at 10:00 a.m., in 
room 2123 Rayburn House Office Building, Hon. John Shimkus 
(chairman of the subcommittee) presiding.
    Members present: Representatives Shimkus, McKinley, Harper, 
Olson, Johnson, Flores, Walberg, Carter, Duncan, Walden (ex 
officio), Tonko, Ruiz, Peters, Green, DeGette, McNerney, 
Cardenas, Dingell, Matsui, and Pallone (ex officio).
    Staff present: Mike Bloomquist, Deputy Staff Director; 
Samantha Bopp, Staff Assistant; Kelly Collins, Staff Assistant; 
Jerry Couri, Chief Environmental Advisor; Margaret Tucker 
Fogarty, Staff Assistant; Jordan Haverly, Policy Coordinator, 
Environment; Mary Martin, Deputy Chief Counsel, Energy & 
Environment; Sarah Matthews, Press Secretary; Drew McDowell, 
Executive Assistant; Peter Spencer, Professional Staff Member, 
Energy; Austin Stonebraker, Press Assistant; Hamlin Wade, 
Special Advisor, External Affairs; Everett Winnick, Director of 
Information Technology; Jean Fruci, Minority Energy and 
Environment Policy Advisor; Caitlin Haberman, Minority 
Professional Staff Member; Rick Kessler, Minority Senior 
Advisor and Staff Director, Energy and Environment; Jourdan 
Lewis, Minority Staff Assistant; Alexander Ratner, Minority 
Policy Analyst; Tuley Wright, Minority Energy and Environment 
Policy Advisor; C.J. Young, Minority Press Secretary; and 
Catherine Zander, Minority Environment Fellow.

  OPENING STATEMENT OF HON. JOHN SHIMKUS, A REPRESENTATIVE IN 
              CONGRESS FROM THE STATE OF ILLINOIS

    Mr. Shimkus. The subcommittee will now come to order. The 
chair recognizes himself for 5 minutes for the purpose of an 
opening statement.
    Today, the subcommittee will check on the progress of the 
Chemical Facilities Anti-Terrorism Standards Program, or CFATS, 
allowing our subcommittee to review the progress of the CFATS 
program, including overall implementation by the Department of 
Homeland Security as well as overall achievement of benchmark 
objectives identified in the past by the Government 
Accountability Office.
    This program, which Congress authorized in the fall of 2006 
was a continuation of congressional efforts since the terror 
attacks of September 11, 2001, to surgically and directly 
address gaps in Federal law regarding terrorism or other 
intentional acts against high-risk facilities due to their use 
or possession of chemicals of concern at levels of concern. The 
core of this new security-focused law was a process where DHS 
issued risk-based performance standards that required 
vulnerability assessments and the site security plans by 
covered facilities. Most importantly, to avoid overlapping with 
other Federal programs, CFATS was designed to foster 
collaboration between government and regulated parties. Having 
finally set up this program, many had great optimism about its 
possibilities. Unfortunately, the early years of CFATS program 
implementation were marked with several growing pains, some 
more hurtful than others. No one knows that more that our 
witness from the Department of Homeland Security, David Wulf. 
Very few people have demonstrated the courage, commitment, and 
longevity with the program that he has. He's kind of the Cal 
Ripken of CFATS.
    Based on this subcommittee's hearing in March 2014, we know 
Mr. Wulf not only set many remedial goals to address issues he 
found in the CFATS program, but GAO also found areas that 
needed serious attention. GAO provided recommendations to DHS 
on how to correct these areas. I look forward to hearing about 
the progress DHS is making here from Mr. Wulf on the first 
panel, and from Christopher Currie at GAO, who is on the second 
panel.
    I also look forward to a meaningful dialogue with our other 
witnesses representing CFATS regulated stakeholders as well as 
those of organized labor, environmental, and community advocacy 
interests.
    Particularly, I am interested in knowing what steps DHS has 
taken to improve its risk assessment methodology and what that 
has meant for facility tiering, what DHS has done to become 
more effective and efficient carrying out the CFATS program, 
and, finally, what steps has DHS taken to improve CFATS program 
transparency and communication with regulated facilities, 
whether it relates to the facility tiering or employee 
screening. In my opinion, CFATS has had four uninterrupted 
years to course correct and these are threshold questions that 
must be addressed in evaluating whether CFATS is a worthwhile 
investment for the United States taxpayer.
    I know there are some who would like to see the CFATS 
universe expand to also do EPA's job, or OSHA's job, or FEMA's 
job, or addressed some other way and we have had lively 
discussions on the advisability of these changes in the past. 
My own thinking has been guided by two thoughts. Are these new 
requirements advisable as a legally enforceable part of this 
program, filling a security gap that does not exist or are they 
merely an additive burden without security benefits, and 
recognizing the challenges CFATS has faced in the past, CFATS 
must excel at its present obligations before being given new 
responsibilities.
    I want to thank our witnesses for being with us today. We 
look forward to having your experience, wisdom, and ideas.
    [The prepared statement of Mr. Shimkus follows:]

                Prepared statement of Hon. John Shimkus

    The Subcommittee will now come to order; and the Chair 
recognizes himself for 5 minutes for the purposes of an opening 
statement.
    Today, the Subcommittee will check in on the progress of 
the Chemical Facilities Anti-Terrorism Standards Program or 
CFATS, allowing our Subcommittee to review the progress of the 
CFATS program, including program implementation by the 
Department of Homeland Security (DHS) as well as overall 
achievement of benchmark objectives identified in the past by 
the Government Accountability Office (GAO).
    This program, which Congress authorized in the fall 2006, 
was a continuation of congressional efforts since the terror 
attacks of September 11, 2001, to surgically and directly 
address gaps in Federal law regarding terrorism or other 
intentional acts against high-risk facilities due to their use 
or possession of chemicals of concern at levels of concern. The 
core of this new security-focused law was a process where DHS 
issued risk-based performance standards that required 
vulnerability assessments and site security plans by covered 
facilities. Most importantly, to avoid overlapping with other 
Federal programs, CFATS was designed to foster collaboration 
between the government and regulated parties. Having finally 
set up this program, many had great optimism about its 
possibilities. Unfortunately, the early years of CFATS program 
implementation were marked with several growing pains, some 
more hurtful than others. No one knows that more that our 
witness from the Department of Homeland Security, David Wulf. 
Very few people have demonstrated the courage, commitment, and 
longevity with the program that he has--he's kind of the Cal 
Ripken of CFATS.
    Based on this Subcommittee's hearing in March of 2014, we 
know Mr. Wulf not only set many remedial goals to address 
issues he found in the CFATS program, but GAO also found areas 
that needed serious attention. GAO provided recommendations to 
DHS on how to correct these areas. I look forward to hearing 
about the progress DHS is making here from Mr. Wulf on our 
first panel, and from Christopher Currie at GAO, who is on the 
second panel.
    I also look forward to a meaningful dialogue with our other 
witnesses representing CFATS regulated stakeholders as well as 
those of organized labor, environmental, and community advocacy 
interests.
    Particularly, I am interested in knowing what steps DHS has 
taken to improve its risk assessment methodology and what that 
has meant for facility tiering, what DHS has done to become 
more effective and efficient carrying out the CFATS program, 
and, finally, what steps has DHS taken to improve CFATS program 
transparency and communication with regulated facilities--
whether it relates to facility tiering or employee screening. 
In my opinion, CFATS has had four uninterrupted years to course 
correct and these are threshold questions that must be 
addressed in evaluating whether CFATS is a worthwhile 
investment for the United States taxpayer.
    I know there are some who would like to see the CFATS 
universe expanded to also do EPA's job, or OSHA's job, or 
FEMA's job, or addressed some other way--and we have had lively 
discussions on the advisability of these changes in the past. 
My own thinking has been guided by two thoughts: (1) are these 
new requirements advisable as a legally enforceable part of 
this program, filling a security gap that does not exist, or 
are they merely an additive burden without security benefits, 
and (2) recognizing the challenges CFATS has faced in the past, 
CFATS must excel at its present obligations before being given 
new responsibilities.
    I want to thank our witnesses for being with us today. We 
look forward to having your experience, wisdom, and ideas.
    With that, I yield back the balance of my time.

    Mr. Shimkus. With that, I have a minute left. Anyone 
seeking time? No one is seeking time so I will yield back and 
recognize the ranking member of the subcommittee, Mr. Tonko 
from New York, for 5 minutes.

   OPENING STATEMENT OF HON. PAUL TONKO, A REPRESENTATIVE IN 
              CONGRESS FROM THE STATE OF NEW YORK

    Mr. Tonko. Thank you, Mr. Chair, and thank you to our 
witnesses for your testimony, the Department of Homeland 
Security's Chemical Facility Anti-Terrorism Standards, or CFATS 
program.
    CFATS is an important part of our nation's counterterrorism 
efforts to secure high-risk chemical facilities. The program 
was first created in late 2006 through a DHS appropriations 
bill. In the early years, Congress extended the program through 
annual appropriations under the passage of a long-term 
authorization in 2014. Without further congressional action the 
program will terminate in January of 2019.
    Under CFATS certain chemical manufacturing, handling, and 
storage facilities must implement risk-based performance 
standards for vulnerability assessments and site security 
plans. Facilities that possess certain chemicals of interest 
must be screened by DHS. If a facility is deemed a high risk, 
it will be placed in one of four tiers that will establish 
standards appropriate to secure the site. As of May 30th of 
2018 the CFATS program identifies 3,395 facilities as high risk 
with 159 in tier one and 78 in tier two.
    While there is complete agreement around the need for a 
program to keep these chemicals out of the hands of terrorists, 
even the program's most ardent supporters would admit there 
have been implementation problems.
    Over the years, DHS has addressed a number of concerns with 
the program including some of GAO's recommendations which we 
will hear about today, I am certain.
    As Congress considers reauthorization, this is an 
opportunity to review the program and consider what is working, 
working well, and how the program could be improved. This 
includes how we might continue to reduce risks at these sites 
and ensure that workers, first responders, and local 
communities have the information they need to stay safe.
    In my view, we should be working to reauthorize CFATS and, 
hopefully, improving it. But I would caution against a 
permanent reauthorization. It is rare for us to discuss this 
program and a permanent reauthorization may result in even less 
congressional oversight.
    We should also keep in mind that CFATS is not the only 
Federal program to regulate chemical facilities. While others 
are beyond the scope of DHS, I strongly believe Congress should 
be looking at all aspects of risks at chemical facilities, not 
just terrorism.
    Recent incidents should remind us that our concerns must 
not be limited to security issues alone. We should take a 
holistic approach to chemical risks which, obviously, includes 
facility security as well as safety, accounting for the risks 
to the people working there and living in nearby communities 
and facilities' resilience.
    Chemical fires, explosions, and releases can have serious 
consequences regardless of whether an incident was an accident, 
a natural disaster or an act of terrorism. For example, EPA's 
risk management plan program is focused on reducing chemical 
risk in the event of an accidental release. RMP establishes 
emergency measures which help local first responders prepare 
for and respond to a chemical accident.
    In January of 2017, the Obama administration finalized an 
RMP amendments rule but in June of last year EPA delayed that 
rule's implementation, and a few weeks ago EPA proposed a 
reconsideration of the RMP program, which would essentially 
roll back nearly all of the safety measures that were adopted 
in 2017.
    In addition to safety issues, chemical facilities are also 
vulnerable to climate change and natural disasters as we have 
seen during Hurricane Harvey when a power outage and equipment 
failure led to a significant chemical fire at the Arkema 
facility in Crosby, Texas. The Chemical Safety Board's post-
Arkema report recommended the development of comprehensive 
industry guidance to help companies assess their risk for 
potential extreme weather events.
    While we all support keeping these facilities secure, I 
hope we can also address these critical safety and resilience 
issues, and if there is an opportunity to improve CFATS in a 
way that close security gaps, reduce risks, better address 
emerging threats such as cybersecurity and keep first 
responders and workers safer, now is an excellent opportunity 
to consider those changes to the program.
    Again, I thank the chair for calling this hearing and thank 
our witnesses for being here today, and I yield back, Mr. 
Chair.
    Mr. Johnson [presiding]. I thank the gentleman for yielding 
back.
    The chair now recognizes the ranking member of the full 
committee, Mr. Pallone, for 5 minutes.

OPENING STATEMENT OF HON. FRANK PALLONE, JR., A REPRESENTATIVE 
            IN CONGRESS FROM THE STATE OF NEW JERSEY

    Mr. Pallone. Thank you, Mr. Chairman.
    It's been over 5 years since this committee held a hearing 
on the Department of Homeland Security's Chemical Facility 
Anti-Terrorism Standards, or CFATS. Given CFATS' inauspicious 
history, I believe we should have conducted more regular 
oversight. Existing CFATS authorization expires on January 2019 
so it's important that Congress act to continue this program.
    At the same time, there are well-documented gaps in the 
current statute that Congress should address instead of simply 
rubber stamping an extension of the existing program.
    I've been an advocate for increased safety and security at 
our nation's chemical facilities for many years, well before 
the CFATS program was established in 2006.
    My home State of New Jersey, which has a high population 
density, also has a large number of chemical facilities. So the 
consequences of insufficient security are dire.
    The program shouldn't have any gaps, and while it took the 
program five years to approve its first chemical facility 
security plan, I understand we will hear today that 
improvements have been made.
    Nevertheless, there are still shortfalls in the program 
that DHS cannot address without changes to the law. For 
example, several significant categories of facilities are 
exempt from the standards, such as public water systems and 
wastewater treatment plants, and they should be added.
    We should also reject a suggestion from Senate Republicans 
that we exempt explosive manufacturers from this anti-terrorism 
program.
    We also cannot have a conversation about chemical 
facilities without discussing the Trump administration's 
reckless proposal to dismantle EPA's risk management program, 
or RMP, improvement rule.
    This is a common sense update to a nearly 20-year-old risk 
planning and reduction policy for our nation's chemical 
facilities. The rule would have improved chemical process 
safety, assisted local emergency authorities and planning for 
and responding to accidents and improved public awareness of 
chemical hazards at regulated facilities.
    Unfortunately, the administration's decision to walk away 
from the RMP improvement rule has widespread and harmful 
ramifications. Dangerous incidents at chemical facilities 
across the country are happening too often. Forty-six incidents 
have occurred at RMP facilities since Administrator Pruitt 
blocked the RMP improvement rule. Had the rule been in place, 
those facilities would have been required to prepare for and 
implement safety improvements to reduce the frequency and 
severity of those events. The highest profile case occurred in 
the aftermath of Hurricane Harvey at the Arkema chemical plant 
in Crosby, Texas. Heavy rains flooded the facility, causing 
equipment to fail, triggering a chemical fire, and releasing 
hazardous fumes and smoke into the air.
    Last month, the Chemical Safety Court released an 
investigative report on the incident and found that chemical 
facilities are wholly unprepared for extreme weather events 
like floods and hurricanes. Improving the resiliency of these 
facilities will only become more critical as the climate 
continues to change. More frequent flooding and powerful storms 
associated with unchecked climate change increase the risk to 
workers and vulnerable populations in and around these 
facilities which too often are low-income communities and 
communities of color.
    Earlier this year, the New York Times reported that more 
than 2,500 sites handling toxic chemicals are located in flood-
prone areas across the country. It is clear that far more 
remains to be done to ensure chemical facilities are truly 
resilient to this growing threat.
    Mr. Chairman, I also believe we must examine Federal 
chemical safety and security policy holistically. We can't turn 
a blind eye to the administration's actions to undermine the 
efficacy of EPA's RMP program. Preventing terrorism at these 
facilities is important, but accidents and industrial incidents 
due to extreme weather are far more common and they should also 
be given due consideration by this committee.
    We have to ensure the safety and security of workers, first 
responders, and communities living near our nation's chemical 
facilities are being prepared on both fronts.
    And with that, Mr. Chairman--I don't think anybody wants my 
time--I'll yield back.
    Mr. McKinley [presiding]. Thank you, and absent the 
chairman of the full committee, we will now conclude the 
members' opening remarks.
    The chair would like to remind our members that pursuant to 
the committee rules, all members' opening statements be made 
part of the record.
    [The prepared statement of Mr. Walden follows:]

                 Prepared statement of Hon. Greg Walden

    Good morning, Mr. Chairman, and thank you for yielding me 
this time.
    I am glad you have decided to have an oversight hearing on 
the Chemical Facility Anti-Terrorism Standards program--or 
CFATS, which is a program the Committee has been overseeing 
since its inception. This hearing continues Energy and 
Commerce's work this month on Federal preparedness laws for 
deliberate events--like last week's hearing on pandemic and 
health hazard preparedness and response and tomorrow's hearing 
examining the federal reaction to biological attacks.
    In the wake of the terrorist attacks of September 11th, 
Congress assessed Federal authority to address theft, 
diversion, and terrorism at chemical facilities and decided 
accident prevention and process safety laws were insufficient 
to tackle these malicious, and intentional acts. Instead, 
Congress decided a separate and distinct body of law and 
requirements were needed for security purposes. Leaving the 
Clean Air Act to address general safety and accident concerns, 
Congress used CFATS to fill legal gaps in addressing 
intentional acts against this critical infrastructure sector. 
In addition, to avoid overlapping with other Federal programs, 
CFATS was designed to foster collaboration between the 
government and regulated parties.
    Since each chemical facility faces different security 
challenges, CFATS established 18 layered, risk-based 
performance standards for security at chemical facilities. It 
is important to point out that CFATS is a program that not only 
covers huge chemical and petrochemical complexes, but also race 
tracks, wineries and breweries, universities and colleges, and 
hospitals and health care providers--3,400 hundred facilities 
in all.
    However, the CFATS program had to overcome some tough 
years. While there have not been any documented attacks on 
these facilities to date, the program has suffered in the past 
from poor accomplishment numbers, inadequate support from 
senior DHS officials, management and workforce issues, and a 
lack of transparency about the program, especially with the 
stakeholder community. Since we last heard from DHS on the 
status of CFATS, the Department has had four years to correct 
the program and I understand DHS has been steadily making 
progress on these areas. I am eager to find out first-hand what 
that means, not just from DHS, but from some of its past 
critics--the Government Accountability Office and the regulated 
community.
    CFATS must provide value to taxpayers, the Federal 
government, and the facilities that could fall victim to 
intentional attacks. To do that, it needs to not just focus on 
its outputs and become highly proficient at those but stay in 
its lane and not try to emulate or replicate other laws whose 
primary purpose is safety, not security.
    I want to welcome our witnesses for being with us today and 
thank them for sharing their views with us.
    With that, Mr. Chairman, I yield back the balance of my 
time.

    Mr. McKinley. We wish to thank all of our witnesses for 
being here today, taking the time to testify before this 
subcommittee.
    Today's witnesses, beginning with the first panel, will 
have the opportunity to give opening statements followed by a 
round of questions. You know how this works.
    Our first witness panel for today's hearing includes Mr. 
David Wulf, the Acting Assistant Secretary for Infrastructure 
Protection with the Department of Homeland Security.
    Mr. Wulf, we appreciate you being here today and we will 
begin the program with you and you're recognized for your 5 
minutes to make an opening statement.

  STATEMENT OF DAVE WULF, ACTING DEPUTY ASSISTANT SECRETARY, 
INFRASTRUCTURE PROTECTION, U.S. DEPARTMENT OF HOMELAND SECURITY

                     STATEMENT OF DAVE WULF

    Mr. Wulf. Thank you so much, Mr. Chairman. I really do 
appreciate the opportunity to be here and thanks as well to 
Ranking Member Tonko and other members of this committee.
    I am excited to be here to provide an update on the 
progress that the Chemical Facility Anti-Terrorism Standards, 
or CFATS program, continues to make in fostering security at 
high-risk chemical facilities across this nation.
    When I last testified before this committee in 2013, no 
question but that the CFATS program was in a very different 
place, having experienced some significant difficulties in its 
early years. But we had at that point implemented a 
comprehensive corrective action plan and had begun making 
measurable forward progress.
    At the time, I emphasized the importance of long-term 
authorization for this critical anti-terrorism program and I am 
very grateful for the leadership that you all provided--that 
this committee demonstrated in securing the 4-year CFATS 
authorization that was signed into law in December of 2014.
    So as we now find ourselves nearly 3 \1/2\ years into the 
authorization period, I am grateful that this committee is, 
again, taking a lead role in ensuring continuing long-term 
authorization of CFATS.
    Now, as I am sure you'll hear me say once or twice today, 
the stability that has come along with long-term authorization 
has driven unprecedented progress as we have worked with CFATS-
covered facilities to make America's high-risk chemical 
infrastructure a truly hard target with literally tens of 
thousands of security measures having been put in place at 
high-risk chemical facilities across the nation.
    So the stability afforded by long-term authorization has 
facilitated our planning and execution of important 
programmatic improvements while it has also afforded regulated 
industry stakeholders with the certainty they deserved as they 
planned for and made significant investments in CFATS-related 
security measures.
    I am very pleased that you'll be hearing today directly 
from CFATS industry stakeholders about their direct experience 
with CFATS. Doug Brown, Jamie Conrad, Steve Roberts, along with 
a host of industry associations, have been true leaders in 
promoting a strong culture of chemical security across the 
Nation and I really appreciate their presence and that of the 
other witnesses here today.
    As we are all too aware, the threat of chemical terrorism 
remains a real and very relevant one. Around the globe, we 
continue to see bad actors seeking to acquire and using in 
attacks chemicals of the sort that trigger coverage under CFATS 
and the threat stream continues to reflect that chemical 
facilities themselves remain an attractive target for 
terrorist.
    I can tell you with certainty that the work we are doing in 
concert with our committed stakeholders across the wide variety 
of industries and facilities that compose the CFATS-covered 
universe is making a real difference in protecting the nation, 
and having had the opportunity to work closely with my 
counterparts in other nations and to co-chair the G-7 Global 
Partnerships' Chemical Security Working Group, I can absolutely 
tell you that what we are doing here in the United States 
through CFATS what you have helped build with your support for 
long-term authorization is absolutely the envy of the world.
    With its 18 comprehensive risk-based performance standards 
and its nonprescriptive flexible approach, CFATS is well suited 
to enhancing security across the very diverse universe of high-
risk chemical facilities.
    So what have we been doing to make CFATS even stronger as 
we have enjoyed the stability of long-term authorization over 
the past 3 \1/2\ years?
    Well, we have improved processes and we have seen 
unprecedented progress in the pace of inspections and in the 
review and approval of facility site security plans, 
eliminating a backlog of security plan reviews 6 years ahead of 
earlier GAO projections.
    We have developed and launched an improved risk assessment 
methodology that effectively accounts for all relevant elements 
of risk and have reassessed the level of risk associated with 
nearly 30,000 facilities across the Nation.
    We have implemented the CFATS personnel surety program, 
affording the highest tiered CFATS-covered facilities the 
ability to ensure that individuals with access to those 
facilities have been vetted for terrorist ties and we have 
significantly reduced burden across our stakeholder community, 
having built and launched a streamlined more user-friendly 
suite of online tools through which facilities submit risk 
assessment or top-screen surveys and develop their site 
security plans.
    So in addition to facilitating all this progress, long-term 
authorization as compared to our former reality of 
authorization through the annual appropriations process enabled 
us to continue to recruit and retain top talent and it reduced 
the possibility of another lapse in authority such as occurred 
during the October 2013 government shut down.
    In addition to the confusion this situation created among 
our industry stakeholders, the need had arisen for us to take 
enforcement action to address the national security threat at a 
CFATS facility during this period of lapse in appropriations. 
The underlying statutory authority for such enforcement action 
would have been in doubt.
    I know this is not a situation that anyone wants to see 
repeated. So to finish on a bit more of a positive note, I 
would, again, like to thank this committee and your top-notch 
staff for your leadership in the CFATS reauthorization process.
    We are fond of saying that chemical security is a shared 
commitment and, not unlike the role of our industry 
stakeholders who have embraced and helped us to build this 
program in so many ways and the role of our committed and very 
talented team at DHS, the role of Congress and of this 
committee in shaping and authorizing CFATS for the long term 
has been hugely important and I am looking forward to working 
further with you as we drive toward reauthorization this year.
    So thank you so much, Mr. Chairman. I look forward to your 
questions and to the dialogue here today.
    [The prepared statement of Mr. Wulf follows:]
    [GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
    
    Mr. McKinley. Thank you for your testimony, Mr. Wulf, and 
if I could recognize myself for 5 minutes to begin the round of 
questioning.
    Mr. Wulf, last time you testified before the committee one 
of the key issues identified by GAO regarding CFATS was 
Homeland Security's approach to calculating risks and in fact 
they concluded DHS did not take into consideration all the 
elements and consequences of threat risk and vulnerability.
    Your written testimony mentions an enhanced risk assessment 
and tiered methodology that Homeland Security believes more 
accurately reflects a facility risk.
    Has DHS changed its policy to risk analysis?
    Mr. Wulf. Yes. In fact, Mr. Chairman, we have.
    So we took very seriously the dialogue we had with this 
committee--took very seriously the recommendations we received 
from GAO, recognizing that our previous risk-tiering 
methodology was not as comprehensive as they could have been. 
It was very focused on the consequences of terrorist attacks 
and less so on vulnerability and threat.
    We commissioned a peer review with a committee drawn from a 
panel of experts from across academia, government partners, and 
industry. We received some excellent recommendations as to ways 
in which we could enhance our risk-tiering methodology and we 
set about doing just that.
    So in the fall of 2016, we did in fact launch a new and 
improved risk-tiering methodology that accounts for all 
relevant elements of risk. So consequence, vulnerability, and 
threat, and we set about retiering the universe of chemical 
facilities against that new tiering methodology.
    Mr. McKinley. With this tiering methodology, I am just 
curious--has it been peer reviewed what you've done on that 
methodology?
    Mr. Wulf. Yes. It sure has. So after we developed the 
methodology we drew together another group of experts, again, 
from across government academia and our industry community to 
go over the methodology--to make recommendations for potential 
tweaks before we finalized the methodology.
    And following that, we embarked upon a verification and 
validation process that was conducted by Sandia National Labs, 
which advised us that our methodology was in fact sound, was 
working as intended, and at that point, we launched upon the 
retiering process.
    Mr. McKinley. Again, back on the tiers, Mr. Wulf, almost 
half the group changed tiers onto this new methodology. Fifteen 
percent apparently left the program and four became newly 
regulated.
    And so my question is, is what quality reviews and are 
there updates occurring to make sure that you are appropriately 
tiering everybody that should be in the system and, as the 
engineering room counts up the numbers, your numbers total over 
100 percent. So I am curious if there is a discrepancy in your 
math.
    Mr. Wulf. That is a good question. So I would say the way 
to look at the math is, looking at the number of facilities 
that had been previously tiered, that group should add up to 
100 percent.
    So of that group, about 36 percent of previously tiered 
high-risk facilities stayed put at the same tier level.
    About 48 percent, as I think you mentioned, moved across 
tiers from one tier to another and about 15 percent of that 
previously tiered population was determined to be no longer 
high risk, using the new methodology, and fell out of the high-
risk category.
    So those three numbers add up to 100 percent when you take 
into account the decimals. The additional 4 percent is from the 
population that had previously been not determined to be high 
risk--those previously untiered facilities. Four percent of 
those were subsequently determined under the new methodology to 
be high risk and moved into the risk tiers.
    Mr. McKinley. Just in the time that remains--the 30 some 
seconds--how do we have confidence that you're appropriately 
tiering people, risk-tiering companies.
    Mr. Wulf. So, the risk-tiering methodology is a sound one 
and is very robust and now takes into account all relevant 
elements of risk.
    We have built a system in which human eyes look at tiering 
for each facility as we move through the process and before a 
final tiering decision is issued and if anything looks off--if 
it appears as though a facility might have submitted 
information in a way that doesn't quite make sense, we are able 
to reach out directly through our field inspectors, through our 
compliance case managers directly, to the facility to resolve 
any discrepancies and to ensure that we are in fact issuing the 
correct tier.
    Mr. McKinley. Thank you. Thank you for my question.
    Now, recognize the ranking member, Mr. Tonko from New York, 
for 5 minutes.
    Mr. Tonko. Thank you, Mr. Chair.
    And Mr. Wulf, again, welcome and thank you for your 
testimony. I commend you on the progress that has been made 
over the recent years.
    I believe, however there are ways we can continue to reduce 
risks and improve the program. I want to reference a few issues 
that came up when DHS last testified before this committee on 
the CFATS program. This includes the importance of closing 
security gaps. Is it true that drinking water and wastewater 
facilities are statutorily exempt from the CFATS program?
    Mr. Wulf. Water and wastewater facilities are among the 
statutory exemptions along with facilities regulated by our 
friends in the Coast Guard through the NHTSA program and a 
handful of other exemptions.
    Mr. Tonko. Thank you. And do you think they were exempted 
because there are no risks of terrorist attacks at these sites?
    Mr. Wulf. I was not here when when that exemption went into 
effect. Certainly, I think it might be worth studying what gaps 
may exist in that arena. I think that might be a sound next 
step.
    Mr. Tonko. OK. And is it true that nuclear facilities are 
also statutorily exempt from the CFATS program?
    Mr. Wulf. Facilities regulated by the NRC are exempt.
    Mr. Tonko. And what about Federal facilities that have 
large amounts of chemicals of interest? Are they exempt?
    Mr. Wulf. Facilities owned and operated by the Department 
of Energy and the Department of Defense, both of which have 
robust standards and audit controls of their own, are exempt as 
well.
    Mr. Tonko. Just because a facility is not covered by CFATS 
does that mean it is not a potential target by terrorists? 
Should these sites be monitored at all?
    Mr. Wulf. So, CFATS is very focused. It is a risk-based 
program. It is targeted at the highest--those facilities that 
are assessed to be at the highest risk of terrorist attack or 
exploitation so I think it is an appropriate targeting of our 
best resources to the facilities that are at the highest risk.
    That is certainly not to say that other facilities do not 
present a risk. We have within the Department of Homeland 
Security a suite of voluntary tools and resources that are 
available to other chemical facilities through our chemical 
sector-specific agency.
    We have protective security advisors who work with 
facilities on a voluntary basis across the Nation every day. So 
yes, certainly----
    Mr. Tonko. But that's statutorily imposed. So----
    Mr. Wulf. Yes. Those are not a statutory requirement.
    Mr. Tonko. OK. Obviously, there are very different security 
and regulatory regimes at nuclear facilities--Federal 
facilities--and other sites that have received exemptions.
    But in the past, DHS has expressed concerns over the gaps 
created by these exemptions. A number of years ago, DHS 
testified that the administration's position to support closing 
security gaps at drinking water and waste water facilities--is 
that still the administration's position?
    Mr. Wulf. I think I would have to take that back.
    Mr. Tonko. OK. And does the administration still support 
maintaining EPA as the lead agency for drinking water and waste 
water facility security with the DHS supporting EPA's efforts?
    Mr. Wulf. I think that is another one we would need to take 
back.
    Mr. Tonko. All right. If you can get back to the committee, 
please.
    And can you explain how DHS has worked with EPA in recent 
years to encourage improvements in chemical security at water 
facilities?
    Mr. Wulf. So I can speak more broadly to the work we have 
done with EPA across the chemical sector. So as you probably 
know, in the wake of the tragic explosion at west Texas, an 
Executive order on improving chemical security safety and 
security was issued.
    In implementing that order, we developed a national working 
group composed of us at DHS along with EPA, OSHA, Bureau of 
Alcohol, Tobacco, Firearms, and Explosives and others with a 
role in assuring chemical facility safety and security.
    We took steps to ensure that we were sharing information as 
fully as possibly, comparing notes on inspections, comparing 
notes on facilities that existed in our relative respective 
jurisdictions and ensuring that word was getting out as widely 
as possible about all of the different regulatory and other 
requirements.
    Mr. Tonko. OK. I would simply encourage the committee to 
consider how we might close some of these security gaps before 
we debate creating new ones through additional exemptions and I 
think it's important that we have this holistic approach to 
cover everyone that might be impacted.
    With that, I yield back, Mr. Chair.
    Mr. McKinley. Thank you.
    And now I recognize my colleague from Mississippi, Mr. 
Harper, for 5 minutes.
    Mr. Harper. Thank you, Mr. Chairman.
    Mr. Wulf, thank you for your time being here, and we 
appreciate it. It's such an important issue and topic for us to 
continue to look at and we know that we all want to be on the 
same page here on where we go, what we look at, and how we try 
to strengthen this in the future.
    One of the issues that was identified by the GAO, and also 
a second witness that will be on the next panel, as a place 
that needed improvement was compliance, inspections, and 
enforcement, and I'd like to know what steps DHS has taken to 
improve in this area.
    Mr. Wulf. I appreciate the question. We have made really 
unprecedented progress in our conduct of inspections in our 
review and adjudication of site security plans and have moved 
as well in--as a result have enclosed the backlog of site 
security plan reviews and adjudications.
    We have moved now into steady state phase of the program. 
So, more than 90 percent of the inspections we are now 
conducting for post site security plan approval, compliance 
inspection, variety of inspections. So we have developed 
standard operating procedures for these inspections and I will 
say that the inspections that are happening across the country 
are going well almost across the board.
    Facilities are taking seriously their obligation to 
implement their site security plans. They are putting in place 
planned or new security measures in accordance with agreed upon 
timelines where issues are being identified or found by 
inspectors.
    Nearly always they are being resolved quickly and in good 
faith by the facility. We are not hesitant though where needed 
to use the enforcement authorities with which we have been 
entrusted.
    But our overwhelming bias continues to be to work with 
facilities that are working with us in good faith to come into 
compliance.
    Mr. Harper. Mr. Wulf, let's talk about your--the inspectors 
for just a moment. Is there a--does DHS have minimum 
qualification requirements for inspectors so they could 
demonstrate the knowledge and understanding of the facilities 
that they encounter and relevant guidance on enforcement 
requirements.
    Do you have the minimum qualifications there and, if yes, 
will you provide the committee any written items the department 
has governing inspector qualifications and training?
    Mr. Wulf. Glad to do that, sir, and absolutely, we have 
minimum standards--a pretty high bar for those standards as 
well for our inspectors who go through a comprehensive training 
program when they first come on board at DHS and to whom we 
provide advanced training throughout their careers on specific 
topics such as cybersecurity or personnel surety background 
check focused program among many others.
    There is an exam at the end of the basic training and it is 
rigorous. We also focus heavily on on-the-job training and on 
fostering consistency across our inspector cadre and the 
inspections they conduct.
    We have put in place relatively recently a group of senior 
inspectors in each of our 10 regions and their job is to foster 
training, the development of our inspector cadre and to ensure 
that we are working in a consistent way. But absolutely glad to 
provide you information.
    Mr. Harper. And that would be great. Obviously, the goal 
here is that if you had any inspector come in to any facility 
that there would be a consistent review and finding, do you 
sense that the ongoing training for those inspectors is going 
to meet that?
    Mr. Wulf. Yes, I do. I think, it's never completely 
perfect. We strive for absolute consistency. We appreciate the 
feedback we receive from our industry stakeholders, many of 
whom own and operate companies that have facilities in 
different parts of the country and, if we hear things are 
perhaps a little different in one part of the country than the 
other, we work quickly to address that.
    In some cases there are reasons for that. It may be that, 
one of the kind of game changing things we have done as an 
organization is to begin to take more of a corporate approach 
to inspections.
    So we are looking at a number of issues at the corporate 
headquarters level so if there are policies that apply across 
facilities it may be that a company's facility that is hit from 
an inspection standpoint early on in the process it might 
appear to that facility that it's getting a little more 
thorough treatment than one that's hit later in the process. 
But that is likely only because we have ----
    Mr. Harper. My time has expired, Mr. Wulf. My time has 
expired. Thank you so much, and I yield back.
    Mr. Wulf. Thank you so much.
    Mr. McKinley. Thank you, and now 5 yield 5 minutes to one 
of my latest friends, Mr. Peters from California, for 5 
minutes.
    Mr. Peters. Thank you, Mr. Chairman.
    Thank you, Mr. Wulf, for being here today. I want to 
commend you for the improvements in the CFATS program over the 
last few years.
    A longer-term authorization or focus on fixing the known 
deficiencies in program management have helped to eliminate the 
site security plan backlog and start the process of compliance 
inspections.
    However, a program can only be as good as the statute that 
authorized it. So I wanted to talk a little bit about how we 
might improve the statute, if you thought that was useful, 
starting with effective enforcement.
    In your testimony, you note that where issues have been 
identified during inspections they have nearly always been 
quickly remedied where needed. However, we have utilized our 
enforcement authorities to incentivize compliance.
    So can you explain to me, Mr. Wulf, what kind of types of 
enforcement mechanisms you've been able to use under the 
program?
    Mr. Wulf. So yes, I appreciate the question. So the 
enforcement process within the program I think is in line with 
the flexible nonprescriptive approach to the program and our 
general orientation to work with facilities to foster 
compliance.
    So where issues are identified on inspections, we work with 
a facility, assuming the facility is working with us in good 
faith to resolve them.
    So, occasionally, if, for instance, a planned measure that 
has been agreed in the site security plan to be put into place 
on a certain timeline has slipped on that timeline, it may be 
that there has been a change in personnel, sort of a lack of 
understanding of what was in the site security plan.
    We will work on an agreeable quick time frame to get that 
planned measure in place and frequently those sorts of things 
are resolved at that point.
    If we get into the enforcement structure it is a two-step 
process. The first step involves the issuance of essentially, a 
notice of noncompliance, which gives a facility formally a 
certain period of time, generally, not too much time to come 
into compliance and I am pleased to say before a penalty order 
is issued--I am pleased to say that 95 percent of the cases 
that is enough to bring the facility into compliance.
    Where if we get to a point where a facility has run through 
that period we will go ahead and issue a penalty order. We do 
take into account facility status as potentially, a small 
business, a facility's ability to pay in determining the 
ultimate penalty.
    It's only happened in a small number of cases.
    Mr. Peters. I was going to ask you, so how many times have 
you had to use penalties or cease operation orders for 
facilities that aren't executing their----
    Mr. Wulf. So we have issued penalty orders in three 
instances at this point.
    Mr. Peters. Three instances. OK.
    So that's the number of times you had to enforce against a 
noncompliant facility?
    Mr. Wulf. That's the number of times we have gotten to the 
point of----
    Mr. Peters. To that point, right.
    Mr. Wulf. A penalty, probably in about 70 occasions begun 
the process.
    Mr. Peters. Great. And do you see that the bill that acts 
as it's written--does it give you enough authority to do what 
you have to do? It sounds like that's going fairly well.
    Mr. Wulf. I believe that we have the authority that we need 
to do to foster security at America's highest-risk chemical 
facilities.
    I think it is a regulatory framework that is really well 
suited to the mission at hand and to the diversity of America's 
chemical infrastructure.
    Mr. Peters. Great. Just one other topic then--the effective 
and adequate enforcement mechanisms are crucial to preventing 
noncompliance. We saw the dangers of noncompliance when the 
West Fertilizer Company in West, Texas exploded.
    Facilities that don't report their holdings to DHS and are 
otherwise not identified to the department still pose a risk to 
workers, first responders, and surrounding communities.
    What kind of steps have you taken to address the problem of 
these so-called outlier facilities?
    Mr. Wulf. Yes. So, certainly, a high priority for us, 
ensuring that we are getting the word out as widely as possible 
to facilities about their obligations to report information to 
us through the top-screen.
    So we work through industry associations. We participate in 
conferences. We drill down to the state and local level through 
state industry associations, though recognizing that not all 
chemical facilities, companies are members of these 
associations.
    Wee get creative. We work through----
    Mr. Peters. I am going to run out of----
    Mr. Wulf [continuing]. The state and local law enforcement, 
preparing lists of facilities and comparing information about--
--
    Mr. Peters. We are out of time. But I have 5 seconds for 
you to tell us if there is anything Congress can improve in 
this area. Is there anything you would ask us to improve within 
the law?
    Mr. Wulf. No. I think we have what we need from an outreach 
standpoint.
    Mr. Peters. Thank you.
    Mr. Chairman, I yield back.
    Mr. McKinley. Thank you, and the chair now recognizes Mr. 
Johnson from Ohio for 5 minutes.
    Mr. Johnson. Thank you, Mr. Chairman, and Mr. Wulf, thanks 
for joining us today.
    I've heard concerns that any changes to Appendix A 
including through guidance might not be subject to notice and 
comment.
    So would changes to Appendix A by guidance be subject to 
public notice and comment based on requirements of OMB?
    Mr. Wulf. So yes, I appreciate the question, and Appendix A 
is a list of chemicals of interest--320 or some chemicals--is 
part of our regulation and so, under the Administrative 
Procedures Act it cannot be adjusted or changed without going 
through the notice and comment rulemaking process. So as things 
currently stand, that would be the----
    Mr. Johnson. Even through guidance?
    Mr. Wulf. Pardon me?
    Mr. Johnson. Even through guidance.
    Mr. Wulf. That's right.
    Mr. Johnson. OK.
    Mr. Wulf. I think it would be considered significant 
guidance that would need to go through notice of rulemaking.
    Mr. Johnson. OK. Great.
    Previously, GAO indicated that DHS does not systematically 
solicit feedback to assess the effectiveness of outreach 
efforts and does not have a mechanism to measure effectiveness 
of your outreach activities.
    Mr. Currie, in his written testimony, indicated that DHS 
developed a questionnaire to solicit feedback on outreach with 
industry stakeholders.
    Would you please walk us through the questionnaire and 
explain whether it's been effective?
    Mr. Wulf. Yes. Absolutely. I am glad to do that.
    So, we have taken GAO's recommendations seriously. As you 
mentioned, we have developed that outreach questionnaire. I do 
believe it is effective. We are in the relative early stages of 
its deployment.
    We are using it as we go out to conferences as opposed to 
going facility by facility during inspections or compliance 
assistance visits.
    We ask in this questionnaire those who participate in our 
engagements to give us some feedback on the content, on the 
speaker, on the relevance of the information, on the extent to 
which they expect to be using the information to inform their 
chemical security risk-based decisions.
    You know, the challenge sometimes is to get the 
questionnaire into the hands of the people who have actually 
participated in the event as we are guests at these 
conferences. We don't necessarily control the attendee email 
distribution lists.
    So we work with organizers of the conference to push it 
out. To this point, we have received upwards of 60 responses 
back. Ninety-seven percent of those who responded reported that 
information was relevant and highly useful.
    So we are going to continue to look at how we can expand 
the use of the questionnaire. I think it is very much a 
worthwhile tool.
    Mr. Johnson. Good. OK.
    Well, since the last time the department testified before 
our committee the Government Accountability Office has made 10 
recommendations for improvements to the CFATS program.
    What progress have you made on those recommendations?
    Mr. Wulf. I appreciate that, and I appreciate GAO's 
engagement and very helpful oversight and recommendations over 
the course of the year.
    I am confident that we are among the most thoroughly 
scrutinized programs in the government and pleased that GAO has 
recognized our significant forward progress over the year and, 
happy to report that we have made a lot of progress in 
implementing GAO's recommendations.
    I think those recommendations, broadly speaking, fall into 
a couple of different bins. One of those focused on our risk 
assessment process, our tiering methodology.
    We, as I've mentioned in this hearing, made a lot of 
progress in developing our new risk-tiering methodology, one 
that comprehensively accounts for all relevant elements of 
risk. Along with that, we have launched a new and very much 
streamlined and user-friendly suite of online tools to 
facilitate tiering.
    I am confident that when GAO issues its next report it will 
recommend or it will close out the remaining recommendations 
related to our development of our tiering methodology--the 
conduct of the tiering peer review among other tiering-related 
issues.
    The second bin I think concerns, broadly, our internal 
processes and controls and, we have made a lot of progress on 
that front, too, executing a 95-point action plan to improve 
the program, developing standard operating procedures on things 
like enforcement and on the conduct of inspections, developing 
metrics to measure the effectiveness of the program and, 
pleased to report, based upon those metrics, facilities that 
are within the program have enhanced their security very, very 
measurably under CFATS. It's a program that is working.
    Mr. Johnson. Well, great. Well, thank you for your 
responses. I yield back, Mr. Chair.
    Mr. McKinley. Thank you.
    And I now recognize our colleague, Mr. Green from Texas, 
for 5 minutes.
    Mr. Green. Thank you, Mr. Chairman.
    Secretary Wulf, thank you for being here. I have a very 
urban district in Houston in East Harris County that's home to 
one of the largest petrochemical complexes in the world so I 
know how important CFATS is and I'd like to thank you for your 
work in implementing these safety standards, and I'd heard a 
lot of good things about the work.
    I was glad in your earlier testimony or question you 
acknowledged that CFATS, because it was called anti-terrorism 
standards, we are more likely to have a natural disaster than 
we are a terrorist.
    In fact, in my area, I think we could take care of the 
terrorists pretty quickly. As I say in Texas, we don't have any 
shortage of small arms. So but Hurricane Harvey that hit our 
community--and I know the other issue was the--that facility 
out in Crosby, Texas, and that's not my area but East Harris 
County is.
    But a lot of our refineries literally were under water in 
the Houston Ship Channel and that's what my concern is and 
maybe we need to focus on that, although, admittedly, when we 
passed the Chemical Facilities Anti-Terrorism Standards program 
we didn't think about natural disasters.
    But now we need to recognize that because about every 7 
years in Houston, Texas or southeast Texas we get a tropical 
storm or a hurricane, and although the last one with Harvey I 
don't know how we could ever plan for 55 inches of rain in 4 
days.
    So but can you talk about how subjecting CFATS to a yearly 
authorization through the appropriations process before 2014 
put a burden on the program?
    Mr. Wulf. Yes, absolutely. Glad to. Until we attained long-
term authorization, we were subject to the vicissitudes of the 
appropriations process.
    So going from year to year or, worse, from continuing 
resolution to continuing resolution. When the government shut 
down----
    Mr. Green. I think every federal agency has that problem.
    Mr. Wulf. Yes. When the government shut down in October or 
November--October 2013, our stakeholders didn't know whether 
CFATS continued in force.
    We didn't know if we needed to take enforcement action to 
address a national security threat at a CFATS facility, whether 
the underlying statutory authority was in existence.
    So long-term authorization in December of 2014 was huge for 
us. It enabled us to plan for and execute important 
improvements to the program, some of which I have detailed here 
today.
    It provided our industry stakeholders with the certainty 
that they deserved as they thought through making significant 
investments in CFATS-focused security measures.
    So I cannot underscore enough how important continuing 
long-term authorization for the program is.
    Mr. Green. Do you think we need to put specific language in 
there? Because when we have these shut downs that our committee 
doesn't have a whole lot to do with since we are not 
appropriations.
    Mr. Wulf. Yes.
    Mr. Green. But our military still functions. Our law 
enforcement functions. Why would we not want our terrorism 
safety or even if there is a natural disaster during a shut 
down? So do you think we need specific language to say that?
    Mr. Wulf. So I think the language we have in the current 
authorization does the trick there.
    But I think you have summed up exactly the importance of 
longer-term authorization to continue--the program continues in 
force regardless of what is happening on the appropriations 
front.
    Mr. Green. Do you currently feel that the facilities 
labeled high risk have enough incentive through the program to 
reduce that risk and do you see facilities switching tiers 
commonly after a high risk designation?
    Mr. Wulf. So, as we have gone through the retiering process 
using our new risk tiering methodology, we have seen some 
shifting across tiers. We have seen some new facilities come 
into the program, some previously designated high-risk 
facilities move out of the program. But I do think that 
organically the CFATS program promotes the consideration by 
facilities of safer processes, consideration of different 
chemicals.
    So, there is an incentive for facilities to lower their 
level of risk by doing things differently based on the CFATS 
program and over the course of the program we have seen about 
4,000 facilities that have changed their processes, changed 
their chemical holdings, and dropped out of high-risk status, 
which we view as a good thing.
    Mr. Green. Well, in a way that's good--they are responding 
to the threat. Has the industry response been in revamping of 
the chemical safety assessment tool, or CSAT?
    Do you feel the program is now easy enough to comply with 
if you're a small-scale manufacturer?
    Mr. Wulf. Yes, I do. I think we made some significant 
strides forward with CSAT 2.0, that new online suite of tools. 
The amount of time it now takes facilities to work through the 
process of submitting a top-screen or a site security plan has 
been cut by about 75 percent across the board.
    The tool is much simpler. It's more of a Turbo Tax sort of 
model. Duplicative irrelevant questions are no longer seen by 
facilities. So greatly simplified and we have had really 
tremendous feedback from our industry stakeholders on it.
    And, in many respects they helped us to develop it. They 
were closest to the pain of working through the old system. 
They were able to help us understand ways in which we could 
simplify it and make it more user friendly.
    Mr. Green. Well, Mr. Chairman, thank you for your patience. 
In my area, we don't have those smaller facilities that you 
have.
    Mr. Wulf. Yes, I know.
    Mr. Green. Chemical plants and refineries who run 250,000 
barrels a day. So but I know that we like to go where the 
problems are, not just be a paper pusher.
    So thank you, Mr. Chairman.
    Mr. Wulf. Yes. You're in the center of the petrochemical 
universe.
    Mr. McKinley. Thank you.
    And the chair now recognizes Mr. Duncan from South Carolina 
for his 5 minutes.
    Mr. Duncan. Thank you, Mr. Chairman.
    Back in 2014, I was on the Homeland Security Committee and 
I worked with them to help reauthorize CFATS for 4 consecutive 
years.
    H.R. 4007, Protecting and Securing Chemical Facilities from 
Terrorist Attacks Act of 2014 was under jurisdiction of both 
Homeland and Energy and Commerce. Now we are back to yearly 
funding extensions and this creates instability for both DHS 
and companies operating under the program.
    If Congress were able, Mr. Wulf, to provide multi-year 
authorization like we did back in 2014 how can we ensure DHS 
will update the program as intended?
    Mr. Wulf. So we are very incentivized to try to continually 
improve the program. I think a long-term authorization gives us 
the stability that we need to focus on those improvements.
    We have made a number of them over the course of the last 4 
years. We are eager to push forward through the rule making 
process to engage with our stakeholders through notice and 
comment in a number of different areas----
    Mr. Duncan. How can we be certain that you will take the 
stakeholders' comments into consideration?
    Mr. Wulf. I think we have demonstrated over the course of 
the last 4 years that we take very seriously our stakeholders' 
comments and that we seek to involve them in the program.
    This whole effort is a shared commitment. It wouldn't work 
without the buy-in of our stakeholders. We have put into place 
tens of thousands of security measures at facilities across the 
country.
    So, they know in many ways best ways in which we can 
improve the program. That's why we have involved them in the 
development of the new risk-tiering methodology. That's why we 
have involved them in the development of the new suite of 
online tools and their input on those fronts has been 
invaluable.
    Mr. Duncan. I think as long as they know how to comply and 
what you're going to expect of them it makes it easy for them.
    Let me shift gears for just a minute. There is a company in 
my home county, Austin Powder, and it's a company facility 
there in Clinton and previously noted how duplicate regulations 
cost them substantial amounts of money.
    The facility has explosive regulated both by the ATF and by 
DHS under CFATS. The compliance mandated under CFATS does not 
measurably improve their facility security. It seems ATF 
adequately protects against theft and diversion.
    So given the cost of compliance, which stakeholders in the 
explosives industry face in return for no measurable security 
gain, what is your opinion on exempting those in the explosive 
industry already regulated by ATF from the CFATS program?
    Mr. Wulf. So we are certainly sympathetic--sensitive to 
concerns about duplicative regulation. I think in the case of 
explosive materials, there is regulation in place with ATF.
    I think we are talking about a universe of about 30 
facilities that are regulated both by CFATS for explosives only 
and also by ATF. ATF and DHS have different programs but I 
think they are both solid programs. So, we are open to working 
with the committee on a path forward there.
    I am not sure I completely agree with the premise that 
CFATS doesn't provide any additional security benefit but there 
are certainly measures in place at ATF-regulated facility. I've 
spent a dozen years myself at ATF. A very solid program there. 
And so, among the things that I would not lose too much sleep 
over exiting the program, explosives are one of those.
    I will note, though, that ATF's program does not address 
explosives' precursor chemicals. So, I think many of those 
facilities receive benefits still under CFATS with respect to 
the regulation of security of explosives' precursor chemicals--
for instance, ammonia nitrate.
    Mr. Duncan. So do you think the redundancy and overlap of 
regulations are OK? I don't hear a whole lot of jurisdictional 
prejudice in your answer there.
    We are going to look at that. We are going to look and see, 
because what we are trying to do is make sure that businesses 
aren't faced with multiple compliance burdens when one agency 
can handle it, and we run into that too much in government, I 
think, where you've got this jurisdictional overlap and one 
agency is coveting that and they don't want to give it up when 
there maybe be a better agency that can handle it. And in this 
case, DHS might be the best agency and take it away from ATF--I 
don't know that--or vice versa.
    Mr. Wulf. Yes. We are happy to work with you on that.
    Mr. Duncan. Thank you.
    Mr. Chairman, I yield back.
    Mr. McKinley. Thank you. Now I recognize my colleague, Mr. 
McNerney from California, for 5 minutes.
    Mr. McNerney. I don't know if I sense a little reluctance 
in that acknowledgment, Mr. Chairman.
    I thank the panelist. Mr. Wulf, I missed your testimony and 
I apologize about that. Now, there are several categories of 
threats. I am going to list a few of them.
    There is natural disasters. There is physical attacks. 
There is industrial accidents and cyber attacks. Do you feel 
that cyber attacks are on par with the others in terms of risk 
to public safety and health?
    Mr. Wulf. I think cyber is a very important threat vector 
and I think that, no question but that America has critical 
infrastructure and that includes America's chemical 
infrastructure is in the cross-hairs of cyber criminals.
    Mr. McNerney. Well, I've learned from the utility industry 
that there is some difficulty getting information sharing 
across because of lack of security clearance within the utility 
industry mainly because of the length of time it takes to get a 
security clearance.
    So you think that that is also an issue with the chemical 
industry is a lack of security clearance within the industry 
prohibiting information sharing that could be helpful in safety 
areas?
    Mr. Wulf. I think, certainly, getting appropriate folks 
across the industry cleared to receive classified threat 
information is helpful.
    We maintain a program called the private sector clearance 
program through which we grant clearances to folks in the 
private sector to include those who serve on our sector 
coordinating counsels.
    So I think, certainly, to the extent we can streamline that 
process, that's a good thing.
    Mr. McNerney. Would it be helpful for the legislative 
branch to get involved in streamlining that process or would 
that be cumbersome?
    Mr. Wulf. I think we are working the issue. It is a high 
priority for us. I think it's sort of a process thing, in my 
view, that, we need to continue to focus like a laser beam upon 
and we are certainly committed to doing that.
    Mr. McNerney. Well, suppose someone goes into the industry, 
say, from the Department of Energy with a pretty high clearance 
level--a Q clearance or some clearance--top secret clearance. 
How long would it take them to get the clearance to get 
information sharing once they go into industry?
    Mr. Wulf. Yes. I would hope not very long. I might have to 
get back to you on exact time lines.
    Mr. McNerney. Yes. I have a specific case where it took 
someone with a top secret clearance 18 months to get a secret 
clearance in industry.
    Mr. Wulf. Yes, not good.
    Mr. McNerney. OK. Well, I'd like to follow up on that and 
hear specifically how that that's going to be----
    Mr. Wulf. Happy to talk with you more about that program.
    Mr. McNerney. OK. Do you think that there is--on a 
different subject, is there resistance to safety regulations by 
industry of regulations that actually provide safety to the 
public?
    Mr. Wulf. Although our security-focused regulation has 
positive benefits from a safety standpoint, I don't know if I 
am in a position to talk about the extent to which there may or 
may not be resistance to EPA's or OSHA's safety-focused 
regulations.
    I would hope not. I think there is a strong culture across 
the chemical industry of safety and security. So my expectation 
is that they are meeting requirements across the board.
    Mr. McNerney. Right. It just takes one bad player to cause 
an accident to hurt the whole industry.
    Mr. Wulf. Yes. Absolutely.
    Mr. McNerney. So I think we both and industry understand 
that and are anxious to work with regulatory bodies such as 
yours.
    Mr. Wulf. Yes.
    Mr. McNerney. OK. Mr. Chairman, I am going to yield back. 
I'll give you a minute.
    Mr. McKinley. Thank you.
    Now the chair recognizes Mr. Flores from Texas for 5 
minutes.
    Mr. Flores. I thank the chairman and I thank this 
subcommittee for holding this important hearing.
    On April 18th, 2013 one of the communities in my district, 
that being West, Texas experienced a disastrous explosion that 
took 15 lives. Twelve of them were first responders. So CFATS 
is important to me and to my district.
    Furthermore, it was really disturbing to learn from the 
findings that were released 3 years later that this wasn't an 
industrial accident. It was actually arson.
    That said, the citizens of West deserve great credit for 
how they've been resilient in rebuilding their community and 
the rebound of West today is really remarkable.
    As the current authorization for CFATS is set to expire in 
January of next year, we must carefully consider how the 
program is measured and what improvements should be made or 
could be made in the reauthorizing legislation.
    I want to thank all of today's witnesses for their insight 
in this hearing. And so now I'll move to my question for Mr. 
Wulf.
    Some people argued that the greater public sharing of 
chemical vulnerability information--or the CVI, as we call it--
is necessary for communities to be better prepared.
    So, Mr. Wulf, I have three subquestions under that. First 
of all, to whom does Section 2103 currently allow access to 
CVI?
    Mr. Wulf. So that section of the statute currently allows 
access to state and local government officials who essentially 
have a need to know that information in performing their 
official duties in the first response arena--emergency planning 
arena.
    Mr. Flores. So the next question would be do you think it's 
wise to have CVI publicly disclosed?
    Mr. Wulf. I do not. The reason we developed the chemical 
terrorism vulnerability information protection regime was to 
keep close hold among those who have a need to know information 
about high-risk chemical facilities and the chemical holdings 
at those sites.
    Mr. Flores. OK. And so that brings us to the next one. Some 
people have suggested that local emergency planning commissions 
should have access to CVI. Is there a reason to not provide it 
to them?
    Mr. Wulf. So local emergency planning commissions perform 
an important function. But they vary in their--in their 
composition. So there are certainly folks who are members of 
local emergency planning missions who do have a need to know 
information about high-risk chemical facilities and chemical 
holdings.
    So those first responders, those emergency planners, we 
absolutely want to ensure that they have the information they 
need to perform their official duties.
    But we need to balance that with the need to ensure that we 
are not sharing so broadly that we make it easy for terrorists 
and other adversaries to obtain information to effectively have 
a roadmap to America's highest risk facilities.
    Mr. Flores. If you have first responders that are CVI 
trained, would it be appropriate to share the information with 
those first responders?
    Mr. Wulf. Absolutely.
    Mr. Flores. OK. Mr. Chairman, this has been helpful and I 
thank you.
    I yield back the balance of my time.
    Mr. McKinley. Thank you very much, and now the chair 
recognizes Mr. Cardenas from California for 5 minutes.
    Mr. Cardenas. Thank you very much, Mr. Chairman. I 
appreciate the opportunity to discuss this very, very important 
issue that affects all Americans.
    Thank you for being here, Mr. Wulf. Earlier this year at a 
subcommittee hearing before the House Committee on Homeland 
Security, chemical safety advocate Paul Oram testified that 
facility owners should be required to develop and maintain 
employee input plans.
    Mr. Oram commented that, ``Employees are often the most 
vulnerable in the chemical release but also the most 
knowledgeable about problems and remedies.''
    So with that, has DHS encouraged or required facility 
owners to consult with employees when developing security 
vulnerability assessments?
    Mr. Wulf. So I appreciate the question. We certainly urge 
companies--we urge high-risk facilities to involve their 
employees in development of site security plans and I would say 
that almost across the board employees are involved in the 
development of those plans.
    The 2014 long-term authorization act makes clear that to 
the extent practicable, facilities should be involving employee 
and my expectation and my general understanding is that 
facilities are doing just that.
    I mean, facility employees are the ones developing plans.
    Mr. Cardenas. So the facilities' owners--these plants 
voluntarily give that feedback to you? If it's not one of the 
checklist things that the department asks, by the way, do you 
have an employee input plan on your site?
    Mr. Wulf. It is not a checklist thing. We are not really a 
checklist program. But we are a program that engages very 
constructively with facilities. So that is voluntary feedback. 
That's the experience----
    Mr. Cardenas. OK.
    Mr. Wulf. --of our inspectors working with these 
facilities.
    Mr. Cardenas. So that feedback right now is ad hoc? It's 
just as----
    Mr. Wulf. I don't know if I'd characterize it as ad hoc, 
and there is not a check box.
    Mr. Cardenas. OK. Well, I'll describe it as ad hoc if there 
is not a formal process. Five years ago when the last oversight 
hearings on the CFATS program then under Secretary Rand Beers 
noted on the record that the department's strategic 
communications plan may eventually include ``systematic 
outreach to facilities including employees at the facilities.''
    Has systematic outreach become the norm in the CFATS 
program?
    Mr. Wulf. Yes. I am pleased to say that it has and we have 
an outreach engagement plan. We identify areas of priority from 
year to year and we focus on ensuring that we are getting the 
word out to those relevant communities and that certainly 
includes to the organized labor--relevant organized labor 
communities.
    Mr. Cardenas. Mr. Oram also stated that public confidence 
is critical to the success of the CFATS program and the secrecy 
is not in the best interest of the communities.
    I couldn't agree more. As a parent, I would not want to 
know if I lived down the street from a facility that puts my 
family at risk. I would want to know as much as we believe 
possible.
    Do you agree that this is important to proactively engage 
communities living near or next to these facilities?
     Mr. Wulf. So I think, again, it's a balance. I think we 
need to ensure that those who are charged with protecting our 
communities, our first responders, our emergency planners have 
the information that they need. The balance, though, is in 
ensuring that we are not making sensitive information so widely 
available that it can be accessed by those who would seek to do 
harm to the community. So it's a balance.
    Mr. Cardenas. So what, if any, specific steps has DHS taken 
to improve community outreach and engagement through the CFATS 
program?
    Mr. Wulf. So, as part of our outreach engagement plan we 
are out talking to local emergency planning committees. Those 
can include members of--and frequently do include members of 
the community and public officials, first responders, emergency 
planners. That is one of the main means by which we are out 
across the relevant communities.
    Mr. Cardenas. Thank you. I can't stress enough how 
important it is for employees and local members of the 
community to be involved in disaster assessment and 
preparedness process.
    These individuals are the ones bearing the greatest risk. 
They work, live, shop, walk to school, pray, and drive to jobs 
near these facilities and they might be at high risk and they 
need to know about that. And yet, they are often left in the 
dark when it comes to disaster preparedness. Their voices are 
critical to the facility and community safety and I hope that 
we can work together to improve engagement efforts under the 
CFATS.
    So I appreciate your time. Thank you very much. I yield 
back.
    Mr. Wulf. Thank you.
    Mr. McKinley. Thank you very much.
    The chair recognizes Mr. Walberg from Michigan for 5 
minutes.
    Mr. Walberg. Thank you, Mr. Chairman, and thank you, Mr. 
Wulf, for being here.
    In your written testimony you indicate that DHS has 
conducted over 3,500 compliance inspections and that, and I 
quote your statement, ``Nearly across the board results of 
these inspections have been positive.''
    That's good. Could you elaborate a little bit more for us?
    Mr. Wulf. Yes. No, I am glad to.
    So we are in sort of steady state compliance inspection 
phase. Most of the inspections we are doing across the country 
are post-site security plan approval inspections.
    So we are assessing the extent to which facilities are 
doing what they signed up to do in developing their site 
security plans, whether they are implementing those plans, 
whether they are putting in place new security measures along 
the time lines agreed to in the plans and I'd say almost across 
the board that is absolutely happening. That has been our 
experience in conducting these inspections.
    Where we have identified issues nearly always we are able 
to resolve those with the facility in pretty short order.
    So, the chemical industry stakeholder community is taking 
its obligations seriously under CFATS. Those facilities that 
have been identified as being at the highest risk of terrorist 
attack or exploitation that are covered by CFATS are taking 
their obligations seriously and are implementing their plans.
    They have put into place literally tens of thousands of 
security measures at facilities across the country. So, really 
appreciate their commitment to the program and their buy-in.
    Mr. Walberg. Do you sense and your inspectors sense that 
they see you as a partner with them--that it's a benefit and 
not a burden?
    Mr. Wulf. I do. Yes, I do. And I think, the program is one 
that lends itself to a little bit of that partnership approach. 
Certainly, we are regulators.
    But this is a nonprescriptive regulatory framework. So we 
are in a position to work with facilities to identify security 
measures within a site security plan that make sense, given 
that specific facility's unique circumstance.
    So, really pleased to be able to work with facilities that 
way, and we will say also that we prioritize not just being out 
there to conduct inspections but to provide compliance 
assistance.
    So to talk with facilities, to talk with those who own and 
operate those facilities about options for meeting the spirit 
of the 18 CFATS risk-based performance standards.
    So, I think it is a really unique and--I want to say 
uniquely effective program that is well suited to the diversity 
of the Nation's chemical industry infrastructure.
     Mr. Walberg. I encourage that. We certainly know of other 
entities that are involved in regulating and inspecting at the 
work site, at the business, that there is no relationship. This 
seems to be a partner relationship.
    Mr. Wulf. Yes.
    Mr. Walberg. This is an important----
    Mr. Wulf. Absolutely, and we rely on our industry 
stakeholders very much to help us think through potential 
improvements to the program, to develop new tools like our new 
and improved suite of online tools through which top-screens 
and site security plans are developed to help us develop things 
like our new risk-tiering methodology.
    So, in a lot of ways it is a thriving partnership 
relationship with our entire stakeholder community. I am very 
grateful for that.
    Mr. Walberg. Thank you.
    Your written testimony notes that where necessary DHS has 
utilized our enforcement authorities to incentivize compliance. 
Can you elaborate on that? Explain that a little more?
    Mr. Wulf. Yes. I am glad to.
    So we have a two-step enforcement process. As I mentioned, 
the vast majority of the time we are able to resolve issues 
without getting into the enforcement process.
    But in about 70 instances over the history of the program 
we have begun the process. We have issued a notice of not 
compliance that, under the law, gives a facility a specific 
amount of time to come into compliance.
    I am happy to say that most of time that is sufficient 
where cooperative work with the facility has worked to nudge 
the facility into compliance.
    But if that doesn't work we will go ahead and issue a 
penalty order, and in all cases--and it's only three cases in 
which we have had to get to the penalty order--that has been 
the thing that has compelled compliance.
    So our overwhelming bias is to work with facilities and, 
certainly, the vast majority of facilities out there are 
acting, in my experience, in good faith and are committed to 
the program and understand--committed to meeting their 
obligations under CFATS.
    But in the small number of instances where that is not 
happening, we will go ahead and use those enforcement 
authorities.
    Mr. Walberg. Thank you.
    I yield back.
    Mr. McKinley. Thank you very much.
    Now the chair recognizes Ms. Matsui from one of the three 
possible states of California for the next 5 minutes.
    Ms. Matsui. I think we are still going to be united--still 
one state.
    Thank you, Mr. Chairman. Today we have talked a lot about 
the industries and facilities that we calmly associate with 
chemicals. But the CFATS program also covers many types of 
facilities that we don't always think of as using high-risk 
chemicals like hospitals and universities.
    In Sacramento, we have four major hospital systems 
including an academic medical center, which represents the 
second largest employer in the district.
    So I am pleased that DHS has emphasized the importance of 
stakeholder involvement, and I've also heard that the agency 
and hospitals in California collaborate well.
    You've emphasized the CFATS as a nonprescriptive regulatory 
framework, which gives flexibility to regulated facilities.
    What are some of the unique challenges that hospitals face 
under CFATS and how has DHS worked with hospitals to tailor 
security measures to those challenges?
    Mr. Wulf. And I appreciate that question. You're absolutely 
right. The universe of facilities covered under CFATS is a very 
broad one.
    So, we prioritize getting out across the relevant 
communities and working to address the unique circumstances of 
facilities such as hospitals.
    So hospitals, college university campuses can't necessarily 
be secured in the same way as a more traditional chemical 
manufacturing or chemical distribution site.
    We need to maintain reasonably open access to the site. You 
have members of the public coming in and out so, what we have 
recommended in cases like that and in the conduct of our 
compliance assistance with those sites is taking kind of an 
asset-based approach to security.
    So you're not necessarily constructing a perimeter around 
the entirety of the hospital but ensuring that where those 
sensitive chemicals are being held you have the requisite 
security in place. So that tends to be the approach for 
facilities such as hospitals.
    Ms. Matsui. OK. Thank you.
    I understand the CFATS has improved its risk-based 
performance standards and risk calculations based upon actual 
threat level and facility vulnerability.
    It makes me wonder--as climate change is increasing the 
frequency and severity of extreme weather if the CFATS couldn't 
be used to address weather-related vulnerabilities.
    Recently, the Chemical Safety Board released their 
investigative report on the Arkema chemical plant fire and 
explosion in Crosby, Texas. The CSB found that the plant was 
not adequately prepared for the extreme flooding that occurred 
during Hurricane Harvey and that a number of equipment failures 
occurred as a result.
    The CSB also indicated that other facilities in flood prone 
areas face similar problems and made recommendations on how to 
address some of these risks.
    I think that many of these recommendations are relevant to 
CFATS facilities. Do you believe that the damage extreme 
weather causes facilities covered by CFATS is a serious threat 
to the safety of surrounding communities?
    Mr. Wulf. I think, certainly, natural hazards are just that 
and we have certainly seen them impact chemical facilities.
    Ms. Matsui. OK. Do you think a CFATS security plan should 
consider the threat of severe weather and help protect facility 
worker and communities? Why or why not?
    Mr. Wulf. So I think it's important that CFATS be able to 
stay focused on security. It is a security-focused anti-
terrorism program.
    But I will note that there is a lot about the CFATS program 
and about security measures that are put into place or that are 
required to be put in place at CFATS-covered facilities that 
has a positive impact in addressing the facilities' resilience 
in the face of natural disasters.
    So, we require facilities to develop response plans, to 
conduct training, to conduct exercise, to conduct exercises to 
make contact with their local first responders and all of those 
things are equally important in both the terrorism context, in 
the deliberate manmade attack context, as well as in the 
natural disaster context and we have seen it play out in 
instances in which, for instance, a tornado hit a CFATS-covered 
facility in Illinois and it was very well prepared.
    Ms. Matsui. So you're really preparing--in essence, to 
really coordinate these activities more in the sense of part of 
the program to review how to do this so, in a sense, it's part 
of the program?
    Mr. Wulf. I don't believe it makes sense to make it a 
formal part of the program. I think it's important that we 
retain our focus on security. But, again, I think their 
security and safety are very much complementary.
    There are agencies that focus squarely on the safety issues 
on those hazards. We work very closely with the likes of EPA, 
OSHA, with our friends at FEMA, within the Department of 
Homeland Security.
    So I think as a Federal Government community we are very 
much committed to that.
    Ms. Matsui. OK. Thank you very much.
    I yield back.
    Mr. McKinley. Thank you. And now the chair recognizes the 
chairman of the full committee, the gentleman from Oregon, Mr. 
Walden, 5 minutes.
    Mr. Walden. Thank you very much, Mr. Chairman, and thanks 
to you for holding this hearing and, Mr. Wulf, thank you for 
being here. We appreciate your guidance.
    I just have a couple of questions. You've been with the 
program a long time--I won't say a very long time--a long time, 
and, frankly, many people credit your leadership and your 
committed staff with the gains the program has made in recent 
years. So, we go through this with different agencies and, 
frankly, depending on who's in charge doesn't seem to matter 
sometimes who's in the White House.
    So this isn't a partisan issue because we have seen it in 
other agencies. But having seen how a less committed senior 
political leadership can wreak havoc on a program, how do we 
know these reforms are permanent?
    Mr. Wulf. Thank you. Thank you, Mr. Chairman. I appreciate 
very much the kind words. We have a great team in place within 
our program and great buy-in and commitment across our industry 
stakeholder community. So it's very much a team effort.
    I can tell you that our new senior political leadership 
with the change of administration is very, very committed to 
the future of CFATS. It remains a priority with this 
administration, very focused on ensuring that we are able to 
maintain positive momentum that we have the resources we need 
to do just that.
    So, we remain focused like a laser beam. I've seen nothing 
but support from the upper reaches of the department and the 
administration.
    Mr. Walden. Right. And some of the witnesses on the second 
panel in their testimony today on CFATS that they say that 
CFATS has made serious improvements in problems it was facing 4 
years ago.
    What do you attribute the progress of CFATS program over 
the course of the last 4 years?
    Mr. Wulf. I appreciate that question.
    I think, first and foremost, I attribute the progress we 
have been able to make to the environment of stability that has 
been fostered by long-term authorization on which this 
committee showed so much leadership in 2014.
    So that gave us the stability that we needed to plan for 
and execute many of the improvements I've detailed here today. 
It afforded our industry stakeholders the certainty they 
deserved as they were thinking through making significant 
investments in CFATS-focused security measures.
    I would say also I would credit a lot of the progress to 
the spirit of openness and transparency which we have strived 
to operate over the past 4 years.
    So, we have a very strong relationship with our industry 
stakeholders. We take their feedback very seriously. We involve 
them in efforts to improve the program. We very much value 
their input.
    And, thirdly, I would point maybe to a willingness to 
change processes--to not stick with the status quo to do game 
changing things like take a corporate approach to inspection 
activity, to take a fresh look at our suite of online tools and 
see what we can do about making them more user friendly, more 
streamlined, and more useful in the development of top-screen 
risk assessment surveys and site security plans.
    So all of the above but at its core, the stability of that 
long-term authorization has been absolutely key.
    Mr. Walden. Well, and as chairman of the full committee, 
you have my assurance that we are going to move expeditiously 
to reauthorize this work.
    Mr. Wulf. We appreciate that.
    Mr. Walden. We know of its critical importance. You keep 
this up, you may get cloned and your staff too because not 
every program and agency achieves these kinds of results.
    So we do appreciate your leadership and that of your team 
and you look forward to working with you so we meet our 
deadlines here and get this reauthorized.
    So with that, Mr. Chairman, I'd yield back.
    Mr. McKinley. Thank you very much.
    The chair recognizes Ms. DeGette from Colorado for 5 
minutes.
    Ms. DeGette. Thank you, Mr. Chairman.
    Thank you for coming today, Mr. Wulf. Right on the border 
of my district is the Suncour oil refinery.
    There are 53,000 people that live within a 3-mile radius of 
that refinery and that includes over 5,000 children under 5 
years old who are particularly susceptible to air toxins.
    The neighborhood that's the closest to the refinery, 
Elyria-Swansea, has a population that's over 80 percent Latino 
with over 25 percent of the residents living with incomes below 
the poverty line, and as you know, these characteristics are 
pretty common for neighborhoods that are nearby industrial 
facilities.
    So I wanted to ask you would you agree that while security 
is important for all chemical facilities, additional 
considerations like mitigation are necessary when you're 
dealing with urban facilities with large populations right 
nearby. Security is not the only issue that these institutions 
or that these refineries and others are facing.
    Mr. Wulf. Well, sure. Yes. Absolutely.
    Ms. DeGette. And one thing that happened over at Suncour we 
have had problems with interruptions from the external power 
supply and, as you know, even brief disruptions to the power 
supply can cause harmful chemical emissions.
    In October 2016, the Suncour refinery suffered an 
accidental power failure that led to release of a yellow cloud 
of smoke, which closed the highway and caused 14 local schools 
to go into lockdown.
    And then they had a second power outage in March 2017 which 
released more than 500 pounds of sulfur dioxide gas and a 
hundred pounds of hydrogen sulfide gas.
    So my question is--I know, you look a little puzzled 
because--but I am wanting to know is power supply security a 
consideration when the Department of Homeland Security 
considers site security plans submitted by high-risk 
facilities?
    Mr. Wulf. So, yes, the power supply is certainly something 
that----
    Ms. DeGette. Is one of the things?
    Mr. Wulf [continuing]. Something to be considered and also 
considering what contingencies are in place it is certainly 
important from a security perspective when the power goes out.
    Ms. DeGette. OK. Does DHS have specific recommendations for 
providing a secure power supply under CFATS?
    Mr. Wulf. I will get back to you on that, certainly.
    Ms. DeGette. Thank you. OK. Now, DHS is not allowed to 
disapprove of the site security plan because it lacks specific 
security measures. Is that right?
    Mr. Wulf. That is correct. It's a nonprescriptive program 
so we work with facilities to assess what makes sense and meets 
the intent of the relevant risk-based performance standards.
    Ms. DeGette. So would you consider a facility secure if it 
suffered a significant chemical release due to a brief power 
outage or would that show that the facility might be 
susceptible to deliberate disruption? Would you look at that?
    Mr. Wulf. It would be something we would look at, 
certainly.
    Ms. DeGette. Now, the CFATS program is intended to protect 
chemical facilities from terrorist attacks. Is that right?
    Mr. Wulf. That is correct, to protect against terrorist 
attack or exploitation. The majority of the facilities we have 
in the program that have been designated at high risk are 
designated as such owing to the threat of theft or diversion of 
chemicals----
    Ms. DeGette. OK.
    Mr. Wulf [continuing]. Being taken offsite and deployed.
    Ms. DeGette. Off site. So the Suncour refinery incidents I 
talked about before caused by accidental power outages they 
would be included in the scope of the program though, right?
    Power outages that are causing chemical releases.
    Mr. Wulf. Yes. The power situation and resilience in the 
face of power, ensuring that the security systems are resilient 
is important.
    Ms. DeGette. Now, what about emissions caused by 
negligence, natural disasters, or other types of actions? That 
would not be included?
    Mr. Wulf. That is not within our purview. But, as I've 
mentioned here, many of the measures that we require to be put 
in place through CFATS such as the conduct of training, 
exercise the development of response plans that are 
applicable----
    Ms. DeGette. They would----
    Mr. Wulf [continuing]. In both the natural disaster context 
or manmade attacks.
    Ms. DeGette. They would have that potential spillover 
effect, right?
    Mr. Wulf. Right. Right. A complementary----
    Ms. DeGette. Yes. But, Mr. Chairman, the reason why I bring 
this up is because security is really important to me but there 
is so many other issues.
    I would hope that we can also come to bipartisan agreement 
on how we address these toxic releases, because in my district 
and many other districts in the country, people are living 
right next to these plants and even if it's not a terrorist 
attack or a natural disaster, they are at risk of contamination 
every day.
    So I would hope that would be another issue that we could 
work on in this committee.
    Thank you, and I yield back.
    Mr. McKinley. Thank you very much, and I hope we can 
continue that dialogue on that.
    Now the chair recognizes from Texas Mr. Olson for 5 
minutes.
    Mr. Olson. I thank the chair, and welcome, Mr. Wulf.
    As you know, I am a congressman from Texas 22. I like to 
call that the suburbs of the energy capital of the entire 
world, the massive petrochemical complex along the Port of 
Houston and Houston ship channel.
    Mr. Wulf. Absolutely.
    Mr. Olson. As you know, there are lots of nasty chemicals 
on our highways and our railroads. In fact, this last month, 
Houston had the anniversary but remembered that--see, was it in 
1976 had a tanker turn over a truck with ammonia.
    Six people died. Over 60 were hospitalized. That was right 
by Interstate 610 U.S. 59, right by the Galleria. I know that's 
not CFATS, but my point is those chemicals are all over our 
roads, and that's just ammonia going by traffic.
    It's been talked about, some of the issues with the Crosby 
fire during Hurricane Harvey. I want to talk about cyber 
attacks, because the bad guys now are adjusting to attack us 
through cyberspace.
    What happened at Crosby was a failure of the backup system. 
They had backup power but they didn't test enough. They fired 
up for maybe a minute or two--hey, it's working. It had to 
work. It didn't. And as you know, the chemical--once you lost 
control of the process it was going to come through and have an 
emission.
    And so terrorists could easily hack into there and open up 
those things, do exactly what nature did. So how is CFATS 
adapting to terror attacks through cyberspace?
    Mr. Wulf. Yes, you're absolutely right. Cyber attacks--very 
significant threat vector. Chemical facilities vary in the 
level to which cyber systems are integrated with their 
industrial control systems, with their process systems, and, 
for that matter, with their security systems.
    But there certainly exists a decent population of 
facilities where those systems are very much integrated and so 
one of our risk-based performance standards--and I think this 
was in place before any folks were thinking about 
cybersecurity--one of the 18 risk-based performance standards 
under CFATS focuses specifically on cybersecurity.
    Mr. Olson. All right. Good.
    Mr. Wulf. So we have trained a large number of our 
inspectors to work with facilities that have the fuller 
integration of cyber systems with their industrial control 
systems.
    We have cyber experts on our staff at headquarters who 
review those facility site security plans and provide guidance 
to the inspectors in the--in the field.
    We ask facilities to put in place sound cybersecurity 
practices or other site security things--a very important part 
of our program.
    Mr. Olson. Thank you. That is music to my ears.
    More of a softball question for you. As you noted, CFATS 
was authorized a little over one decade ago. Looking back, 
could you talk about the single biggest lesson learned that 
you've had the first years of the program? What's one thing 
you've learned over those first couple years?
    Mr. Wulf. So I think the most important thing is that it 
takes a community to secure America's chemical infrastructure--
that it's not something we can do alone and it's not something 
we can do without the feedback of our industry stakeholders.
    So, the importance of transparency, the importance of 
openness, the importance of a community wide approach. A shared 
commitment to chemical security is absolutely key and I think 
as a result we have seen a great deal of buy-in and a great 
deal of commitment across our community of owners and operators 
of high-risk chemical facilities.
    Mr. Olson. Thank you. That brings up the next question and 
that is domestic community. How about international community?
    As you note in your opening statement, the threats we have 
seen in our homeland have spiked up following terrorist attacks 
overseas.
    NATO and our allies in Europe are dealing with these 
attacks every single day as are allies all across the world. 
Can you discuss how our CFATS program compares with their 
programs and are we exchanging data with NATO, with other 
countries? Are they exchanging with us? Are we working together 
to address this problem?
    Mr. Wulf. That's a great question, and we are prioritizing 
international outreach. So I actually have the privilege of 
chairing a G-7 global partnership working group on chemical 
security.
    We are engaging with our European Union partners and a 
number of other nations to sort of share best practices, to 
compare notes on chemical security.
    I will tell you that what we are doing here is in many, 
many ways the envy of the world--significantly more 
comprehensive.
    There is a large threat out there. We have been relatively 
privileged not to have as many chemical-focused attacks. But no 
question adversaries around the world continue to seek out and 
to use in attacks chemicals of exactly the sort that trigger 
coverage under CFATS.
    So, we need to remain vigilant. There are other approaches 
to securing certain chemicals, in particular, IED precursor 
chemicals. In Europe, that seemed to be making some headway. I 
think we want to learn from our colleagues over there what is 
working as we think through potentially new approaches at the 
point of sale to high threat IED precursor chemicals, whether 
of a voluntary or a regulatory nature and that's probably 
another hearing for another day. But we learn a lot from our 
international colleagues and I think they learn a lot from us.
    Mr. Olson. I thank you. So my time is expired.
    A final closing comment--you always have a standing 
invitation to come to Houston, Texas, see all that stuff with 
your own eyes. Also, enjoy the best barbecue at the Swinging 
Door in Fort Bend County and also the best Mexican breakfast at 
Bob's Taco Station in Rosenberg, Texas.
    Mr. Wulf. OK. What was the first one? I want to make----
    Mr. McKinley. OK.
    Mr. Olson. The Swinging Door. That's in Richmond. Bob's 
Taco Station is in Rosenberg.
    Mr. Wulf. All right. We are down there quite a bit so I 
will----
    Mr. Olson. Yield back.
    [Laughter.]
    Mr. McKinley. Thank you.
    Mr. Olson. Thank you, Chairman.
    Mr. McKinley. The chair now recognizes the very patient 
member from Georgia, Mr. Carter, for his 5 minutes.
    Mr. Carter. Well, it's certainly going to be hard to follow 
that but I'll do my best.
    Thank you, Mr. Wulf, for being here. I appreciate it.
    I want to echo the comments of the chair of the full 
committee. Just from listening to you, it appears that you have 
a firm grasp of this and have a handle on it and I appreciate 
that. That's good to know.
    I wanted to ask you, it appears that improvements have been 
made in the program as it's gone along, and from what I 
understand in some of my reading that since the implementation 
of CFATS the GAO makes a number of recommendations that appear 
to have improved the program, and I just wanted to ask you 
specifically about two things--: vulnerability and economic 
consequences. Those two things are of concern to me and I just 
wanted to ask, have you changed your overview of these two 
things, particularly of economic consequences? Or the 
management of the program--have you tried to address this at 
all?
    Because I believe that GAO had noted that that was one 
thing that was not taken into consideration enough and that was 
the economic consequences.
    Mr. Wulf. That's exactly right. So GAO made a number of 
recommendations related to tiering and we have taken them all 
very much to heart in developing our new and improved risk 
tiering methodology which does take a significantly more 
comprehensive approach to addressing all relevant elements of 
risk to include consequence, vulnerability as well, looking at 
the sort of inherent vulnerabilities associated with facilities 
on a facility by facility basis--things like, how chemicals are 
stored, the types of containers, among many other things, and 
threat.
    With respect to economic consequences, we have studied this 
very hard in response in response to the recommendation and I 
think just makes sense to have done that anyway.
    Our ultimate conclusion was that the threshold, which is 
actually a classified threshold for significant economic 
consequences to the Nation from an attack on a specific 
chemical facility, is a pretty high one.
    And so, it was based on a review of the facilities in our 
program. They were not facilities on which an attack would move 
the needle from a risk tiering perspective with respect to 
economic consequences.
    So it is not included in our tiering methodology right now 
but we have the resources. We have the knowledge from the study 
to include it as needed if we get to a point where economic 
consequences are, potentially, significant enough from one 
attack on a single facility.
    Mr. Carter. Let me ask you just a couple of simple 
questions, if you will. How do you determine who is to comply? 
Is that incumbent upon the business itself or do you determine 
that or what?
    Mr. Wulf. Yes. So the way the process works is that 
facilities that have holdings of one or more of our 320 
chemicals of interest that are in the regulation self-identify 
if they have those chemical holdings at or above the specified 
threshold or at or above the specified concentration.
    They submit to us what we call a top-screen, so basic 
information about the facility, about the chemical holdings, 
and we run that through our risk tiering methodology and make a 
determination as to whether the facility, based on the totality 
of the circumstances of its facility, of its chemical holdings, 
of its location as relevant--whether it's in an urban or rural 
area, whether that facility is at high risk of terrorist attack 
or exploitation, and if it is--and about 10 percent of the 
facilities that submit this paperwork to us ultimately are 
determined to be high risk--if a facility is issued that 
determination we then issue it a risk tier.
    So it's placed in one of our four risk tiers and then 
embarks upon the process of collaborating with us as it 
develops a site security plan that's ultimately approved and 
then entering into the regular cycle of compliance----
    Mr. Carter. So it is incumbent upon the business to 
initiate it?
    Mr. Wulf. It is.
    Mr. Carter. OK.
    Mr. Wulf. But we prioritize getting the word out about 
those reporting obligations because the community of those who 
hold chemicals is very diverse.
    Mr. Carter. I see. Right.
    Mr. Wulf. So it's not only the traditional chemical 
manufacturers.
    Mr. Carter. Well, very quickly, because I want to get this 
in. I have two major seaports in my district.
    That seems like that would be a bugaboo to try to really 
have an overview of that----
    Mr. Wulf. Yes. No, that's----
    Mr. Carter [continuing]. Of everything that's going through 
those ports.
    Mr. Wulf. Yes. There is a lot of chemical infrastructure on 
the water at the ports. Our friends at the Coast Guard have the 
responsibility actually----
    Mr. Carter. OK.
    Mr. Wulf [continuing]. For managing that. So facilities 
that are regulated by the Coast Guard are specifically exempted 
from CFATS.
    Mr. Carter. Right.
    Mr. Wulf. So we work very closely with the Coast Guard.
    Mr. Carter. Good. Thank you very much.
    Mr. Wulf. Absolutely.
    Mr. Carter. And I yield back.
    Mr. McKinley. Thank you very much.
    Now, if I could, you've been going here almost 2-plus hours 
on this thing. But let me just conclude with one question, if I 
could--the privilege of the chair.
    I want to clarify your answer to Congressman Johnson about 
the listing of items on Appendix 1, because I've spoken to 
several chemical manufacturers in our district and they claim 
that on Appendix 1 is this designation of high priority 
chemicals--you understand that. They claim the existing statute 
is silent over whether it's subject to notice in rulemaking 
versus the sole discretion of DHS.
    I thought you said that it had to go through notice in 
rulemaking. I just want for the record you saying it does go 
under----
    Mr. Wulf. Yes. It is part of our regulation and so I have a 
crack team of lawyers who tell me that as a result of its 
status in the regulation it is subject to notice and comment 
rulemaking pursuant to the administrative procedures.
    Mr. McKinley. So these manufacturers maybe are just 
mistaken where they think it's silent?
    Mr. Wulf. Yes. It may not be explicitly addressed in the 
statute but there are other legal frameworks that apply to it.
    Mr. McKinley. OK. Thank you very much. Thank you.
    Mr. Wulf. Absolutely.
    Mr. McKinley. Seeing that there are no further members 
wishing to participate and ask questions, I'd like to thank our 
witness again for being here today.
    And with that, we will end the first panel.
    Mr. Wulf. Thank you so much.
    [Pause.]
    Mr. McKinley. So if we could, we call up the second panel 
now--and your placards.
    [Pause.]
    OK. We want to thank our witnesses for being here today, 
many of you just went through the first panel and so we begin 
the second panel so--and your taking the time to testify before 
this subcommittee.
    Today's witnesses will have the opportunity to give opening 
statements followed by a round of questions from the members 
that are present.
    Our second panel for today's hearing includes Chris Currie, 
Director of the Emergency Management National Preparedness and 
Critical Infrastructure Protection, Homeland Security, and the 
Justice Team in the U.S. Government Accountability Office; Mr. 
Brown, President and CEO of Brown Chemical Company; we also 
have Mike Wilson, National Director for Occupational and 
Environmental Health in BlueGreen Alliance; Mr. Roberts, 
Principal of Chemical Security Group, LLC; and James Conrad, 
the Principal of Conrad Law and Policy Council on behalf of the 
Society of Chemical Manufacturers and Affiliates; and lastly, 
Yvette Arellano, the Policy Research and Grassroots Advocate of 
the Texas Environmental Justice and Advocacy Services.
    So we appreciate you. The subcommittee appreciates all of 
you for being here today and the patience of working with us on 
this, and we will begin the panel discussion with Mr. Currie 
for his opening statement of 5 minutes.

STATEMENTS OF CHRIS P. CURRIE, DIRECTOR, EMERGENCY MANAGEMENT, 
NATIONAL PREPAREDNESS, AND CRITICAL INFRASTRUCTURE PROTECTION, 
      HOMELAND SECURITY AND JUSTICE TEAM, U.S. GOVERNMENT 
  ACCOUNTABILITY OFFICE; DOUG BROWN, PRESIDENT AND COO, BROWN 
     CHEMICAL COMPANY; DR. MIKE WILSON, NATIONAL DIRECTOR, 
  OCCUPATIONAL AND ENVIRONMENTAL HEALTH, BLUEGREEN ALLIANCE; 
 STEVE ROBERTS, PRINCIPAL, CHEMICAL SECURITY GROUP, LLC; JAMES 
CONRAD, PRINCIPAL, CONRAD LAW AND POLICY COUNSEL, ON BEHALF OF 
   SOCIETY OF CHEMICAL MANUFACTURERS AND AFFILIATES; YVETTE 
   ARELLANO, POLICY RESEARCH AND GRASSROOTS ADVOCATE, TEXAS 
            ENVIRONMENTAL JUSTICE ADVOCACY SERVICES

                  STATEMENT OF CHRIS P. CURRIE

    Mr. Currie. Thank you, Mr. Chairman, Ranking Member Tonko, 
other members of the committee that are here.
    I think this hearing is really well-timed. CFATS is over 10 
years old. We have spent almost a billion dollars of taxpayer 
money implementing it, getting it up and running, and industry 
has spent its own dollars doing the same thing.
    GAO has been assessing this program for almost a decade, 
and I want to be clear that we have no position on 
reauthorization. That's a decision for Congress.
    Our jobs, as always, is to help you make those decisions 
with information on how well programs like this are working. In 
that regard, it's no secret that this program has had 
challenges.
    Today, after numerous GAO recommendations and heavy 
oversight by Congress, CFATS has addressed many of the 
management challenges it faced early on. I think DHS deserves a 
lot of credit for that. I think Congress deserves a lot of 
credit for the oversight.
    I'd like to summarize just some of our past work and where 
DHS is in addressing the recommendations. First, just 
identifying facilities originally that could have been subject 
to this regulation was daunting and a huge challenge.
    In 2014, we identified, through our own work, chemical 
facilities that were not reporting ammonium nitrate holdings, 
for example, to DHS as they were required to do.
    We recommended the DHS work with EPA, other agencies, and 
states to better share their separate data sources to close 
this gap. Since then, DHS implemented this recommendation and 
identified 1,000 additional facilities that should have 
complied with CFATS.
    Assessing facility risk levels, as was discussed a lot on 
the first panel, and improving site security plans has also 
been a complicated process.
    Specifically, we recommended that DHS improve its process 
for assessing facility risk, or tiering, as was mentioned, and 
have this process peer reviewed, and DHS has taken steps to 
address these issues as well.
    DHS also eliminated the backlog for reviewing and approving 
facility site plans, which at one point we estimated to be 7 to 
9 years long.
    More recently, DHS overhauled and streamlined its tools for 
gathering information from facilities and assessing the risk 
and, according to most industry officials and facilities we 
have talked to so far, the new tool is much easier to use and 
understand.
    As of June 2008, DHS told us they've processed hearing 
results for all but 226 facilities nationwide. Compliance 
inspections are also a critical piece of the program. These 
inspections ensure that facilities are implementing and 
maintaining the security measures in their plans.
    In our 2015 report, at that time DHS had only done 83 of 
these inspections. They recently told us the number is now up 
to over 3,500, and this is promising, but DHS still hasn't 
fully implemented our recommendation to establish a final 
procedure for conducting these inspections.
    They have one in draft that they are using and they tell us 
they expect to finalize that later this year. However, just 
fixing past problems is not enough to declare victory. Now it's 
an important time, I think, to shift our mind set from 
establishing the functional components of a regulatory program 
to questions about what do we expect from CFATS in the future.
    Many of these will be addressed in the report we plan to 
issue next month. First, it's critical that the CFATS program 
be able to measure over time how risk and vulnerability are 
actually being reduced and not just focus on outputs like 
inspection numbers.
    In the past, we have found weakness in how the program 
measures performance and we continue to assess their progress 
in this area.
    Second, the program must evolve and can't be static. New 
security threats such as cyber have to be constantly 
considered. Also, the program is in a unique position to help 
the industry by communicating these threats and best practices.
    Further, a balance must be struck between sharing 
information and protecting security. For example, recently 
deadly incidents show how important it is that first responders 
know what they are responding to at these facilities and how to 
address it.
    We are assessing these and other issues in our ongoing work 
and, as I mentioned, we expect a report out on those specific 
things next month.
    This concludes my statement and I look forward to the 
discussion.
    [The prepared statement of Mr. Currie follows:]
    [GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
    
    Mr. McKinley. Thank you, Mr. Currie.
    And now the chair recognizes Mr. Brown for his 5 minutes.

                    STATEMENT OF DOUG BROWN

    Mr. Brown. Good morning, Vice Chairman McKinley, and 
Ranking Member Tonko, and members of the subcommittee.
    My name is Doug Brown and I am President and CEO of Brown 
Chemical, a chemical distributor based in Oakland, New Jersey. 
I am also the current chairman of the National Association of 
Chemical Distributors--NACD.
    I thank you for holding this important hearing today on the 
Chemical Facility Anti-Terrorism Standards program and I am 
pleased to provide testimony.
    Brown Chemical was founded in 1936. It is a fourth 
generation family-owned and operated business with 14 
employees. We operate facilities in Oakland and Patterson, New 
Jersey.
    Brown Chemical direct sells, distributes, or packages over 
350 products to approximately 400 customers in 41 states. We've 
been practising NACD's responsible distribution since its 
inception in 1991 when it became mandatory for all association 
members.
    This comprehensive program addresses environmental, health, 
safety, and security risks. Members companies are third-party 
verified to ensure the highest quality of performance in these 
areas.
    While security has always been an inherent element of 
responsible distribution, after the September 11 terrorist 
attacks NACD specifically added security elements to the 
program and the association continues to enhance these 
requirements.
    In 2013, NACD added a specific security code to responsible 
distribution and consolidated many prior requirements and 
improved others.
    Brown Chemical supports a long-term reauthorization of 
CFATS. I believe the CFATS program has made the chemical 
industry in our nation more secure.
    Since the program's establishment in 2007, the industry has 
invested significant capital and training resources for its 
enhanced security measures at our facilities.
    While these investments did not help grow my business, they 
nonetheless ensured the security of my company, our employees, 
and the community.
    It is undeniable there were growing pains in the first few 
years of CFATS. The Department of Homeland Security has worked 
hard to address these issues and has made substantial 
improvements to run the program more efficiently.
    One reason for the success of the CFATS program is the fact 
that DHS has taken the time to truly learn about the diversity 
of the chemical industry and work with companies on security 
measures that meet the CFATS risk-based performance standards.
    DHS has taken a collaborative common sense approach in 
implementing the program while providing flexibility to each 
unique chemical facility in doing so.
    The clear objective of the CFATS program is to help 
facilities be more secure while not taking a punitive approach. 
DHS has excelled in outreach to the industry in three key ways: 
by publishing numerous fact sheets and lessons learned 
documents, by interacting with facility owners and operators 
during the chemical sector security summits and other industry 
meetings, and always making inspectors and headquarters 
personnel available to talk through issues and answer 
questions.
    The 2014 reauthorization of the CFATS program, which, for 
the first time provided CFATS a multi-year authorization, 
further enhanced security efforts by providing regulatory 
certainty to both industry and DHS.
    This stability allowed DHS to increase efficiencies in the 
program while streamlining the information submission process 
for regulated facilities.
    I believe the CFATS program is strong and needs minimal 
change. One priority I can recommend is to require that any 
changes to the Appendix A chemicals of interest list remain 
subject to notice and comment rulemaking.
    Changes to the COI list could have major impacts on my 
business operations and security investments. Changes may be 
needed upon discovery of new threat information. But it is 
important for regulated companies like mine to be able to 
provide information to DHS and explain the impacts of any 
proposed changes.
    I also support the creation of a program under which DHS 
would recognize companies that meet certain criteria such as 
participation and an environmental health, safety, and security 
program like responsible distribution.
    By acknowledging responsible distributors through measures 
like less frequent inspections, DHS would then be able to 
prioritize resources on the noncompliant outliers that may pose 
a greater security risk.
    Brown Chemical supports the CFATS program and looks forward 
to working with the subcommittee on legislation to reauthorize 
this important regulation. A multi-year reauthorization of 
CFATS will provide the certainty needed to enhance the security 
of my chemical facilities and our nation.
    On behalf of Brown Chemical, I appreciate this opportunity 
to present our views on this important issue and I look forward 
to your questions.
    [The prepared statement of Mr. Brown follows:]
    [GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
    
    Mr. McKinley. Thank you, Mr. Brown.
    And then next on the panel, Mr. Wilson with BlueGreen 
Alliance--your opening statement, please.

                    STATEMENT OF MIKE WILSON

    Mr. Wilson. Thank you, Mr. Chairman, Ranking Member Tonko, 
and distinguished members.
    My name is Michael Wilson. I am the National Director for 
Occupational and Environmental Health at the BlueGreen 
Alliance.
    On behalf of our organization, our national labor and 
environmental partners, and the millions of members and 
supporters they represent, I want to thank you for convening 
the hearing today and for your interest in chemical safety and 
security.
    I am familiar with the risks of industrial hazards because 
I had the privilege of working for 13 years as a professional 
firefighter, paramedic, and EMT, during which time I responded 
to about 10,000 emergency calls.
    I worked in a city with heavy industry centered around 
agriculture, so there were many facilities that used chlorine 
and ammonia and other agricultural chemicals. Responding to an 
incident at one of these facilities meant grappling with a lot 
of uncertainty because the facilities weren't required to 
invite us in and involve us in planning or training for an 
emergency.
    In general, I would say they relied on us if they had an 
emergency but they were reluctant to help us improve the safety 
and effectiveness of our response. Without a doubt, emergency 
response is a necessary aspect of chemical safety and security. 
But it's an indicator of a failure. It's a measure of last 
resort where thoughtful planning and prevention have broken 
down.
    EPA reported this year that most serious chemical accidents 
are preventable if the necessary precautions and actions are 
taken and yet serious industrial chemical accidents continue to 
occur every 2 \1/2\ days across our nation.
    Last year, EPA estimated that about 177 million Americans 
live close enough to an industrial facility to be affected by a 
chemical accident and that these risks fall disproportionately 
on low-income and minority communities.
    CFATS responds to this problem by requiring companies to 
surround dangerous chemicals with security measures and yet, as 
many experts have noted, these measures require continual 
updating to thwart the efforts of a motivated actor. Perhaps it 
is in response to this challenge with security measures that 
thousands of facilities seem to be shifting to prevention 
strategies.
    DHS noted last year that companies reported taking action 
to prevent risks on about 250 dangerous chemicals by replacing 
those chemicals with safer ones, reducing the quantities held 
on site, or switching to less concentrated formulations.
    If DHS is confident in the veracity of these claims, these 
actions do more than manage risks. They actually reduce the 
risk footprint, and in this way they provide protection not 
only from an intentional attack but also from an extreme 
weather event, earthquake, power outage, or mechanical failure 
risks that we've heard from several members today.
    On the other hand, there are about 3,400 facilities that 
have remained in the CFATS high-risk tier and which pose a 
substantial risk to workers and communities.
    Changes to the CFATS program are needed to reward the 
leaders and move the laggards up. CFATS could be strengthened 
with updated requirements in four areas: one, risk management; 
two, risk prevention; three, meaningful participation by rank 
and file worker representatives; and four, emergency response.
    The State of California, the third largest refining state 
in the country, adopted these approaches last year in a 
sweeping new refinery safety regulation, which was motivated by 
a large flammable vapor explosion at the Richmond Chevron 
refinery. That incident created a 100 square meter vapor cloud 
that ignited and endangered the lives of 19 workers and caused 
some 15,000 people downwind of the plant to seek medical 
attention.
    California's comprehensive new regulation is informed by 
the industry's own best engineering and management practices 
developed over the last 20 years and largely shifts from a risk 
management to risk prevention framework. While California is 
improving the safety of refineries in communities, however, 
U.S. EPA is proposing to substantially weaken the Federal 
chemical disaster rule by rolling back most of its key 
provisions, including all 10 of its prevention requirements.
    These changes will endanger the lives of my former co-
workers in the U.S. Fire Service. They will endanger workers 
and millions of community members and their families who live 
around our nation's chemical facilities. The chemical disaster 
rule should be retained in its original form, not weakened or 
delayed, as the administration has proposed.
    We can and must prevent chemical accidents. I urge you to 
use the reauthorization of CFATS as an opportunity to 
strengthen the program. The results would be fewer explosions, 
fewer injuries and deaths, and a far more resilient industrial 
infrastructure.
    In closing, I would like to thank you again for this 
hearing and for granting me the opportunity to appear, and I 
will be happy to answer any questions.
    Thank you.
    [The prepared statement of Mr. Wilson follows:]
    [GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
    
    Mr. Harper [presiding]. Thank you, Dr. Wilson.
    The chair will now recognize Mr. Roberts for the purposes 
of an opening statement. You're recognized for 5 minutes.

                   STATEMENT OF STEVE ROBERTS

    Mr. Roberts. Thank you. Good afternoon, Mr. Chairman, 
Ranking Member Tonko, and other distinguished members of the 
subcommittee.
    As a security consultant and lawyer, I've been fortunate to 
participate and work in the CFATS program from the very 
beginning since 2007, more than 11 years ago now, and have seen 
during that time and have participated in dozens of refineries, 
chemical plants, paint and coating manufacturers, agricultural 
facilities, aerospace and defense--a range of CFATS facilities 
that Mr. Wulf spoke about earlier in this testimony.
    Against this backdrop, I am pleased to offer the following 
comments for the committee's consideration: first, reauthorize 
CFATS for multiple years; second, further enhance the 
transparency of the risk tiering process; third, update the 
CFATS rulemaking process; and fourth, ensure that there is 
greater consistency among inspectors and the inspection 
process.
    First, reauthorize CFATS. When the first standalone CFATS 
legislation was introduced 4 years ago, we find ourselves back 
now at the same time, as that legislation nears the end of its 
life. I can certainly say that industry needs the certainty of 
CFATS and reauthorization of CFATS to continue to make its 
investments in the program and continue to implement the 
program. I think DHS also needs the certainty of CFATS to 
ensure its long-term viability of programmatic changes.
    Second, with respect to transparency and risk determination 
process, which we've heard about quite a bit today, ISCD has 
certainly improved the transparency of its risk process. They 
have done many things to help the regulated community 
understand why they may be tiered or not tiered, and includes 
things like webinars, fact sheets, and the like.
    Most significantly--and the agency should get a lot of 
credit--you are willing to call up the agency and have a so-
called technical consultation, essentially asking why am I 
tiered, is there something that I could do, is there something 
I need to know, is there something that's correct or perhaps 
incorrect in this process. And while often that doesn't change 
the needle, unless there was some kind of error omission, the 
mere process of being able to have that conversation with the 
agency is very helpful and welcome.
    That sort of dialogue was not welcome many years ago at the 
beginning of the CFATS program and I think the current 
leadership has a lot to do with that and should be recognized.
    That's not to suggest that I or the facilities for which I 
work always agree with the process. In fact, many times, 
especially with respect to the most recent CSAT 2.0 resteering 
process, companies have said to me, why am I tiered--can I 
appeal that tiering decision--and the answer is no. The 
regulation does not provide for any kind of appeal mechanism.
    In fact, allowing a straight appeal would probably swallow 
the regulation. DHS would spend all of its time on appeals and 
not being able to articulate and move forward with the program. 
So I don't think a straight appeal would be appropriate.
    But something more formal than a technical consultation but 
something less than a formal appeal would certainly help 
facilities to understand is there something they can do, 
especially on the consequence side of the house, for sites that 
have release flammable or toxic inhalation hazard materials--to 
bring that risk down, re-file a top-screen, and perhaps get a 
different result. Right now, we are not able to effectively do 
that beyond the technical consultation.
    Third, the rulemaking process--as we've noted today, CFATS 
has been around for now 11 years. The regulations have not 
changed one word in that 11-year period, and whether it be 
Appendix A or other key aspects of the rule, in order to change 
that rule, to update it, to align it to certain things, that 
process would need to go through the rulemaking process.
    DHS started that process in the summer of 2014 through an 
advanced notice of proposed rulemaking. But that process has 
now stalled. If we take a look at the current rulemaking agenda 
for the Department of Homeland Security just published 
recently, we now see CFATS has been moved to the list of long-
term actions.
    I would urge the committee to require that rulemaking occur 
so we can update the program necessarily in very material ways 
that need to occur for both, in my view, industry and for DHS.
    Fourth, as we've heard a little bit and including from Mr. 
Currie, ISCD should opt to make authorization inspections--
compliance inspections more consistent, more uniform--ensure 
that the same level of knowledge, of rigor, of completeness of 
those processes.
    ISCD has done a lot toward that and I certainly think--and 
have worked with many of these inspectors--they are 
professional, they are courteous, they are very easy going many 
times and friendly.
    However, that does not always translate into the same 
process from site to site, from region to region, even within 
the same region. That inconsistency sometimes and lack of--
differences in knowledge, understanding the actual tools that 
DHS uses, the CSAT process, the different approaches to how an 
inspection actually occurs--the level of detail or lack 
thereof--is an ongoing source of frustration for many 
businesses, many companies, especially those that operate 
facilities from region to region and very clearly see and 
question why we see so many differences boots on the ground 
among the inspection team.
    DHS has recognized that. We hear from them that they are 
going to take steps and are taking steps, as the GAO has also 
recognized, to improve and enhance that process, going forward.
    But I think more is needed. I think further training is 
needed--minimum standards and better consistency horizontally 
between the regions and vertically between headquarters and the 
regions themselves.
    So with that, I appreciate the opportunity to testify, 
holding this important hearing, and be pleased to answer any 
questions you may have.
    [The prepared statement of Mr. Roberts follows:]
    [GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
    
    Mr. Harper. Thank you, Mr. Roberts. We appreciate that.
    And Mr. Conrad, we'll now recognize you for 5 minutes for 
the purposes of an opening statement.
    Thank you.
    Mr. Conrad, could you pull that microphone around in front 
of you a little bit? Thank you.

                   STATEMENT OF JAMES CONRAD

    Mr. Conrad. The button. There we go.
    For over a decade, I have been counsel to the Society for 
Chemical Manufacturers and Affiliates, the only U.S.-based 
trade association dedicated solely to the specialty and fine 
chemical industry.
    For the previous 14 years, I was an in-house lawyer at the 
American Chemistry Council and so I've been working on chemical 
facility security since before 9/11 and I've been continuously 
involved in the CFATS process since it was first enacted in 
2006.
    I've also chaired the ABA's administrative law and 
regulatory practice section. I am pleased to be able to provide 
today with SOCMA's perspective on CFATS. CFATS protects high-
risk chemical facilities and their surrounding communities by 
ensuring that security measures are in place to reduce the risk 
of successful terrorist acts.
    More than half of SOCMA's 115 manufacturing members are 
regulated under the program. We strongly supported and we urge 
Congress to reauthorize the program now before its 
authorization expires this coming January.
    A 1-year reauthorization, however, is not desirable because 
regulatory certainty is crucial to business planning. Complying 
with CFATS is expensive and time consuming, especially for 
small businesses. SOCMA's members want the program to be 
consistent and predictable, and a multi-year reauthorization 
would give them that assurance.
    Through the years, the CFATS program has undergone dramatic 
changes. The early years were a significant challenge for 
everyone, but the program has vastly improved under the 
direction of Deputy Assistant Secretary Wulf, whose earlier 
accomplishments gave Congress the confidence to reauthorize 
CFATS for 4 years in 2014.
    SOCMA believes that the program's continued progress is 
directly attributable to Mr. Wulf's leadership and justifies 
another reauthorization for a comparable period of years.
    The most significant recent improvement in CFATS is Version 
2.0 of the Chemical Security Assessment Tool, or CSAT. The 
original CSAT process was clunky and difficult to use, took 
significant amounts of time and resources to complete.
    The number-one recommendation of SOCMA's CFATS comments in 
2014 was that DHS fix it, and DHS has now done that 
dramatically, and our members uniformly report that it's much 
easier to use and far less resource intensive while still 
giving DHS the information it needs.
    This improvement is extremely important for SOCMA members, 
70 percent of which are small businesses. Most of these 
businesses cannot afford to have dedicated regulatory 
compliance staff nor can they afford to hire consultants to do 
the job for them.
    While I've thus far applauded DHS's efforts, SOCMA does 
have some concerns. It first relates to how DHS tiers or 
assigns risk levels to facilities based on their CSAT 
submissions.
    When Congress reauthorized CFATS, it instructed DHS to 
``share with the owner or operator of a covered chemical 
facility any information that the owner or operator needs to 
comply with this section.''
    Congress could revise this language to create a clearer 
obligation for DHS to share with the facility the exact reason 
for its tier assignment. That would help them understand how 
they could lower their risk tiers.
    The second concern is the personnel surety program. 
Currently, PSP only applies to tier one and two facilities, but 
DHS is considering applying it to tiers three and four.
    SOCMA believes this is premature. These facilities, by 
definition, pose lower risks and the PSP program continues to 
impose burdens in terms of time and delay.
    SOCMA believes DHS should work with the Department of 
Justice and the FBI to rigorously assess both what risks are 
avoided and what costs are imposed by the process, and we think 
such a multi-agency review is necessary before we expand it 
further.
    We also believe CFATS should recognize voluntary industry 
programs that enhance the safety and security of hazardous 
chemicals and thus complement what the CFATS program does.
    The leading chemical industry trade associations have 
organized and implementing demanding stewardship initiatives 
such as SOCMA's ChemStewards to manage and improve 
environmental health, safety, and security performance--a 
public-private partnership that leveraged these industry 
stewardship programs like ChemStewards to benefit both chemical 
facilities and the public.
    And then last, I will emphasize a point that's been made 
before about the continuing importance to use rulemaking in 
amending Appendix A, and I will agree with Director Wulf.
    Currently, the Administrative Procedure Act requires 
Appendix A to be changed through rulemaking because it's 
already part of the rule, and so that will continue to be the 
case, unless that were to be changed by new legislation, which 
we would not support because it's important for facilities to 
be able to get the information to the DHS that it needs to 
understand them. The bottom line is that CFATS is working and 
working far more successfully and efficiently than a lot of 
other regulatory programs.
    CFATS inspectors generally interact well with facilities 
and the agency has an effective compliance assistance program. 
Facilities are more secure and the public is safer today 
because of this program.
    Congress should reauthorize it to maintain that progress.
    Thank you.
    [The prepared statement of Mr. Conrad follows:]
    [GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
    
    Mr. Harper. Thank you, Mr. Conrad.
    The chair will now recognize Ms. Arellano for 5 minutes for 
the purposes of an opening statement.
    Welcome.

                  STATEMENT OF YVETTE ARELLANO

    Ms. Arellano. Thank you, Chairs and Ranking Members, of the 
Energy and Commerce Committee and Subcommittee on the 
Environment.
    Thank you for this opportunity to speak on the proposed 
rule to roll back and eliminate critical protections for my 
community in Houston Texas that are part of EPA's 2017 chemical 
disaster rule.
    I am disappointed that the EPA and its rulemaking has 
chosen to only hold one hearing in Washington, D.C., making it 
difficult for voices like those in my community to be heard.
    But I am relieved that I can bring my experience to this 
hearing. My name is Yvette Arellano. I am here on behalf of 
Texas Environmental Justice Advocacy Services.
    We are a nonprofit working to educate and mobilize our 
community in southeast Houston, including Manchester and the 
surrounding neighborhoods, which have high concentrations of 
chemical facilities.
    The EPA is required to regulate effectively under the risk 
management plan and CFATS. This exposes our communities which 
include significant communities of color and low-income 
families to more toxic air, pollution, and disproportionate 
harm from chemical disasters.
    As illustrated too well from Hurricane Harvey, too often we 
experience a toxic flood on top of the threats we already face 
from hurricanes and heavy rains. That comes on top of disparate 
health and safety impacts we already face around the year 
because EPA refuses to do its job to protect us from the 
frequent toxic releases and pollution these facilities send 
across the fence line into our communities.
     At Hartman Park, which is right across the street from the 
Valero refinery, communities painted a mural reflecting that 
nearly every child that plays in the park is in the shadow of a 
nearby chemical facility--a far cry from what people at this 
hearing see out of their window in Capitol Hill and D.C.
    Communities in Manchester never know which incident 
requires evacuation or sheltering in place. We hear the sirens 
go off. I heard the sirens go off, or alarms go off, for a vote 
and that sent my stress levels high.
    People live in constant fear of releases or incidences 
while their children are playing outside. In hurricane seasons, 
it's bad enough that families have to prepare for their lights 
to go out and ensuring that they have enough food and water.
    No one should have to shelter in place due to a hurricane 
as toxic chemicals flood their homes, wondering what to do if 
facilities down the street will have a catastrophic explosion, 
chemical fire, chemical release, as what happened in our 
community and neighborhoods during Harvey. People deserve the 
right to know the information necessary to make informed 
decisions for them and their families.
    The chemical disaster rule contains important safeguards 
that would help communities like mine and across the country 
with common sense provisions, most importantly, for our already 
over exposed communities.
    We need this fully effective right now and we need to 
require facilities to take action to prevent fires, explosions, 
and disasters including by ensuring they actually look for 
safer ways to operate before a disaster starts. It also would 
have increased the availability of basic information we need to 
know, like chemical safety data sheets and emergency response 
contacts so communities can try to find ways to protect 
ourselves if a serious incident happens.
    Community members should get the information from each 
incident they're exposed to without delay and it's essential 
for facilities to do real incident investigation reports that 
they cannot ignore in planning to prevent future problems.
    I want to highlight that the rule finalized in early 2019 
and came afterward by the EPA and after over a hundred groups 
working with TEJAS called for action, starting in 2011, as 
disasters were happening across the country and people in 
Washington, D.C. didn't seem to pay attention.
    It also provided for a better coordination through sharing 
information first responders need and assuring practice 
notification and exercises happen to prepare without delay.
    EPA cannot justify repealing all of the prevention and 
weakening other important requirements and it has refused to 
face the fact that it's taking away protections meant to save 
lives and prevent harm, especially to communities like ours, 
right across the fence line from chemical facilities.
    These rollbacks don't come without community costs as 
fires, toxic releases across the country on this 
administration's watch, especially the Arkema explosion in 
Crosby after Hurricane Harvey, demonstrated.
    A lack of information puts the surrounding community and 
first responders in jeopardy. First responders on the scene had 
to be evacuated and received medical treatment for inhaling 
dangerous chemicals from the blast.
    Community members are still dealing with the aftermath of 
chemical debris which is visible on their lawns and cars. The 
Valero refinery and other nearby facilities released a spike of 
benzene and other toxic chemicals. But most of these were 
missed because EPA and states turned off or moved most of the 
air monitors.
    I urge this committee to consider the impacts on your 
neighbors, on our neighbors, our families, without critical 
protections like those in the chemical disaster rule and ask 
you to call on President Trump and the administration and 
Administrator Pruitt to drop the hazardous plan that the EPA is 
considering which would revoke lifesaving protections for 
communities across the country, preventing children and 
vulnerable communities from chemical disasters.
    The way EPA originally found was necessary should not be a 
partisan issue and we call on Congress and EPA to protect 
communities, not chemical companies.
    Communities across the country remain in harm's way and 
this is especially scary as we drive around Houston with 
billboards saying hurricane season has begun--be prepared.
    [The prepared statement of Ms. Arellano follows:]
    [GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
    
    Mr. Harper. Your time has expired. I apologize.
    We'll give you opportunity during the questioning. Thank 
you very much.
    It's now time for the members to ask questions. I want to 
thank each of you for your appearance here and for your insight 
and the experience that you bring.
    And Mr. Roberts, I would like to ask you a question first. 
We've from GAO that one of the challenges faced by DHS with the 
implementation of CFATS is compliance enforcement.
    Your written testimony points out that there's 
inconsistency with inspections and enforcement from region to 
region. Can you elaborate some on that and perhaps give us some 
suggestions on how to correct that?
    Mr. Roberts. Certainly. Let me emphasize again the 
inspectors are, almost without fail, are extremely helpful.
    They're friendly, professional, but there continues to be a 
lack of, it seems, consistent knowledge in various areas of the 
program, including the specific way the regulation itself may 
work--the confusion oftentimes between what regulation is and 
implementing guidance.
    As we know, CFATS is a risk-based performance standard. 
That means that DHS can't prescribe the particularly security 
measure a facility must implement or may not--or does not need 
to implement for plan approval, and we've had many instances 
over the years, especially as DHS has upticked, obviously, it's 
compliance inspections in the last few years where the specific 
manner and nature of those inspections simply is not the same 
region to region and even within the same region.
    Some of that may go back to training. Some of it may go 
back to the prior biases or lack thereof of the inspector who 
may come from a prior Federal background.
    Some of that goes to, on a positive side, with familiarity 
of an inspector with the site so they may not feel the need to 
continue to go very deeply sometimes.
    But the way a particular inspector assesses things seems to 
lack any real consistency from site to site, region to region.
    Mr. Harper. And I appreciate the way you have elaborated on 
that. So is this a training issue that we are talking about or 
is it just something that, because of the different 
experiences, we can't correct?
    Mr. Roberts. No, I think it absolutely is a couple of 
things. One is training around the actual rule--training around 
the CSAT portal--how it works.
    We've had instances where inspectors would ask a facility 
to do something in their top-screen that is not possible 
because the top-screen doesn't allow that type of data to be 
inputted. So that just shows me that that particular inspector 
may not understand how the top-screen itself works.
    Certainly, training of the regulation--the top-screen tool, 
the CSAT suite of tools that Mr. Wulf mentioned--certainly, the 
guidance--difference between guidance and regulation, and I 
think, as DHS has indicated, as GAO has indicated, as DHS has 
said in other occasions, they are putting together some more 
specific directives, some more specific guidance material for 
their inspectors.
    I think this is one area where actually a checklist would 
be helpful in terms of understanding what an inspection should 
do, what we should look for, the level and detail an inspection 
should occur, site to site, region to region, regardless of the 
particular nuances of the facility. There are some basic things 
that should occur every time.
    Mr. Harper. Thanks, Mr. Roberts.
    Mr. Conrad, if I may ask you--I know we've had some that 
would argue that information from CFATS-regulated facilities is 
not available to people who should know it. What would be your 
response to that?
    Mr. Conrad. I would say that if that's true it's because 
the systems we have in place to make that happen aren't 
working. There is a statute, the EPCRA--the Environmental--the 
Emergency Planning and Community Right to Know Act--that 
originated in this committee whose sole focus is to make sure 
that state and local emergency planning bodies and fire 
departments are provided with all the information that they 
need to plan for emergencies of whatever sort--natural as well 
as security related--and to be able to respond to them, and the 
statute couldn't be clearer that, for example, those facilities 
shall promptly provide information necessary for developing and 
implementing the emergency plan.
    So it's not qualified, and it requires submission of lists 
of safety data sheets or the safety data sheets themselves, 
inventories of chemicals, or, upon request, the maximum and 
average amounts of a chemical on the site, where it's stored, 
how it's stored, and that information, in turn, can be made 
available to the public.
    And specifically with respect to fire departments, it says 
that the owner or operator with the facility shall allow the 
fire department to conduct an on-site inspection of the 
facility and shall provide to the fire department specific 
location information on hazardous chemicals at the facility.
    So we think the statute is sound. It may well be 
appropriate for this committee to conduct oversight on why it 
is the LEPAS perform more or less well in certain areas. But 
the CFATS program doesn't restrict any of that.
    To the contrary, the statute that you all passed 4 years 
ago expressly preserves all those sorts of information 
disclosure statutes from any effect by a result of the CFATS 
program.
    In fact, this is the CVI guidance from DHS from the Bush 
administration, no less, state--note, state, local, and tribal 
officials including first responders must have access to any 
information that is necessary to plan for and respond to an 
emergency event at a chemical facility.
    It's equally important that this information is available 
in a form that is readily accessible and easily disseminated. 
In most cases, a facility can provide this information that 
contains all necessary operational and facility-specific 
information and excludes CVI.
    But then, as Mr. Wulf said, there's a way for sharing CVI, 
too. So the systems that--the legal system, I think, is sound. 
It's just a question of whether it's really working well.
    Mr. Harper. Thank you very much, Mr. Conrad.
    The chair will now recognize the gentleman from New York, 
Mr. Tonko, the ranking member of the subcommittee.
    Mr. Tonko.
    Mr. Tonko. Thank you, Mr. Chair.
    I believe we must acknowledge that the CFATS program is not 
comprehensive and that security gaps do indeed exist.
    Director Currie, can you give us a sense of the quality of 
information given to first responders near CFATS facilities?
    Mr. Currie. Yes, sir.
    So actually in our ongoing review that we'll issue a report 
on next month we are looking at that very issue and it relates 
to what Mr. Conrad is saying.
    He's right that there's never been an assessment of the 
process itself under CFATS for how well they're coordinating 
with the local emergency planning committees and what they're 
providing.
    That's exactly what we are looking at. We are digging into 
that process to figure out how they're coordinating with those 
committees and what information specifically those committees 
and first responders are actually getting.
    And so, we'll report on that next month.
    Mr. Tonko. You will share that with this committee?
    Mr. Currie. Yes, sir.
    Mr. Tonko. The subcommittee, please.
    Have they always had all the information in preparation 
necessary to respond to incidents at these facilities?
    Mr. Currie. Well, I think one of the things we are looking 
at, as we've talked about today, the CFATS program has only 
been around 10 years and some of these other programs have been 
around much longer.
    So, in the early stages of the program that was not the 
focus. The focus was getting facilities enrolled and things 
like that.
    So, this is something that's evolved over time. Nobody's 
really looked at it, and so that's why we are taking a look at 
it.
    It's an extremely important issue. These are life and death 
situations and it's important they have the information they 
need to respond.
    Mr. Tonko. Thank you. If first responders do not have all 
the necessary information, it makes those security gaps even 
worse.
    Dr. Wilson, what is your sense on some of the security gaps 
in the CFATS program? Do you have any thoughts on the 
exemptions that exist in the program?
    Mr. Wilson. Sure. I think with regard to exemptions, we 
heard earlier around waste treatment nuclear and maritime, and 
I think it's worth assessing whether and to what extent 
security is an element of the safety programs in those sectors.
    And the reason I say that is that in practice, I think 
there's a cultural and operational divide between safety 
engineering and security provisions and yet security and 
engineering are interrelated. So good engineering design drives 
down both safety and security risks but security is often 
missing from engineering practice.
    So last month, the American Institute of Chemical Engineers 
had its conference with a keynote address by the FBI, and the 
reason for that appearance by FBI was to encourage engineers to 
include security in their scope of practice rather than 
relegating it, in a way, to traditional barriers, monitoring, 
and response approaches.
    And so I think it would be worth evaluating if these 
exempted sectors are meeting the CFATS 18 performance standards 
and if they're effectively integrating security into 
engineering practice.
    Mr. Tonko. So, from that, I can assume that first 
responders often--that they may not know exactly what is at a 
facility before having to respond to the incident?
    Mr. Wilson. I would say it's a perennial problem. Despite 
the requirements of the Emergency Planning Community Right to 
Know Act, there are gaps in information, in particular in 
transmitting information to first responders.
    One of the problems with the local emergency planning 
committee structure is that the members of those committees are 
serving voluntarily and yet there is a lot asked of those 
members.
    I served as the state's representative--the state 
Department of Industrial Relations representative--to our state 
emergency response committee in California and saw firsthand 
the difficulty that those members of the local committees--the 
challenges that they carried in trying to implement the 
requirements of a EPCRA and transmitting information 
effectively and so forth.
    Mr. Tonko. I have concerns with EPA's recent decisions 
around the RMP rule. Can you discuss some of the provisions 
that were delayed and what would be rolled back from the latest 
RMP proposal?
    Mr. Wilson. There are 10 provisions having to do with 
incident prevention that are being proposed for removal from 
the program, and we could go through and catalog each of those.
    They are, I think, the most fundamental and most sort of 
protective aspects of the RMP that have been proposed.
    And as I said earlier, one of the reasons I am very 
concerned about that is because of the fact that prevention 
elements provide protection against multiple threats, and we've 
heard from many members today about not only the threat of an 
intentional attack against a facility but the very real threat 
of a natural disaster, of an earthquake--as we are in 
California--of a mechanical failure, and we heard of power 
outage and so forth.
    And so prevention elements or prevention requirements drive 
down that risk footprint in the face of all of those threats. 
Those are proposed to be thoroughly removed under the RMP 
proposal that we are hearing from the administration.
    Mr. Tonko. Thank you, Dr. Wilson.
    With that, I yield back.
    Mr. Harper. The gentleman yields back.
    The chair will now recognize the gentleman from Texas, Mr. 
Green, for 5 minutes.
    Mr. Green. Thank you, Mr. Chairman. I want to thank our 
panel for being here today.
    As I said earlier in our first witness, CFATS was created 
because of what happened in West Texas. But as we found out 
that--and I think the last thing I heard that that was arson 
and still being investigated--but our real challenge is from 
natural disasters, like you just said--earthquakes in 
California, hurricanes and tropical storms in the Gulf of 
Mexico. That's what I would like to focus more on and see how 
we can correct it.
    I have a district in East Harris County, and Ms. Arellano 
is very correct--Manchester has a chemical plant on the west 
side, a thank farm on the north side before the Houston ship 
channel, and a refinery to the east side, and on the south 
they're covered by railroad tracks.
    And that's where Houston literally started back in the 
1830s and 1840s. The Manchester area was actually called 
Harrisburg before there was a city of Houston.
    And so we see a lot of these challenges in urban areas 
where industry is literally right next door to people who have 
lived there and it's in Manchester for 50 years. I know two 
generations at least in that community.
    One of the concerns I had was that during our Hurricane 
Harvey--and I guess I should understand that when it was coming 
in, our air monitors were shut down.
    I've been told that I have probably the most air monitored 
district in the country because we have EPA. We have the city 
of Houston there they have jurisdiction. We have the county of 
Harris with a pollution control agency and, of course, the 
State of Texas, and it's not just the air monitors but the 
other issue is that most of the rising water was literally on 
the bottom of those plants and refineries and chemical plants 
because of the 55 inches of rain in four days--how can you do 
it?
    The other problem, though--and I hope the industry is 
listening because we've talked about it--is that we have huge 
tanks that hold product, either crude oil or refined product, 
and the way they're filled up is that they have floating roofs.
    The problem is when you get that much water on that roof, 
those rooves actually turn and you end up--whatever the 
emissions come from that, but it also can overflow because of 
the heavy rain.
    So we've got a lot of challenges in our area and to keep 
working with it, but we used to have community groups, and I 
hardly hear about them anymore--Manchester, Pasadena, Bay 
Town--the community groups, and I would go to those meetings 
sometimes and the industry would come in and sit down with 
their neighbors along the fence line, and I am not so sure 
those are still going. Is that still active in other parts of 
the country and maybe not in our area?
    Mr. Wilson. Is that question to me?
    Mr. Green. Yes.
    Mr. Wilson. I am not aware of those kinds of meetings 
taking place but I absolutely agree with your characterization 
of the problem.
    One of the things that California has done in its refinery 
safety regulations has required companies to look at inherently 
safer technologies wherever feasible and it has also required, 
and I think in the example that you have just given, risk 
management strategies that require redundancy and independence 
of safeguards to prevent a cascade of failures so, for example, 
in the event of a power failure, losing safeguards, one after 
the other.
    And of course, California is the third largest refining 
state and is, you know, producing jet fuel and gasoline. It's 
inherently hazardous, and so we felt it was important to be 
very clear about the importance of introducing and requiring, 
actually, independence and----
    Mr. Green. I only have 26 seconds.
    Mr. Wilson. Sorry.
    Mr. Green. And I agree, because even with the Arkema 
problem--wasn't in our district but the redundancies weren't 
there. In fact, our Harris County district attorney has 
launched an investigation into that plant and see why it 
didn't.
    Ms. Arellano, in your testimony, you talked a lot about how 
communities like ours in Houston face additional challenges 
during natural disasters due to their proximity to these 
plants.
    What recommendations would you do for industry to improve 
their relationship with community groups and civic clubs, 
because I visit Manchester civic club as often as I can and, 
typically, one of our refinery staff is there to answer 
questions.
    What are some of the suggestions TEJAS would tell us that 
we could do and inform people in the neighborhood but also, 
just how we can do this better? Because those refineries and 
chemical plants are probably not going to move because they've 
been there for 50 years.
    Ms. Arellano. These industry partners, they do come out to 
the civic associations. But they talk about scholarships. They 
talk about fire, indoor air pollutants. They'll hand out fire 
detectors.
    But they won't talk about the latest expansion. They won't 
talk about a permit notice they had out--like the one they have 
out that would increase hydrogen cyanide from 52 tons to 512 
tons.
    They'll go ahead and they'll speak about a backpack 
giveaway event but not give any real information. So I would 
say having true and real information going between industry 
partners and neighboring communities is vital to this process.
    The other thing that I would like people to consider is a 
cumulative analysis of the TCQ is supposed to have some sort of 
cumulative analysis program.
    It's important for us to know exactly the impacts of all 
the neighbors. Just like you said, there is Contanda Chemical, 
it's 87 CO carbon storage tanks with a capacity of a thousand 
to 74,000 barrels of chemical product. At Valero Refining, it 
has 164,000 barrels per calendar day of refining, and then the 
sulfuric acid plant that's Eco Services, original Rhodia.
    So it's important for us to know the impacts of all of 
these aggregated together. RMP facilities have these radiuses.
    But we are not accounting for the toxic impacts on the 
communities, and adding all that information, to not say that 
four facilities are exposing the community to 10 cancer-causing 
substances but instead saying this community is exposed to 40, 
and taking into account that all of them have safety hazards 
and all of them have chemical releases, they all are exposed to 
fires and incidences whether it is--people keep talking about 
these terrorist attacks but the communities are exposed to 
daily toxics.
    They're more frequently exposed to fires from chemical 
releases and fugitive emissions than they are a terror attack.
    So I would hope that this committee considers these 
everyday problems with community members in the decision to 
keep going forward and give people the opportunity to make 
their own decisions--safe ones for them and their families.
    Mr. Harper. The gentleman's time has expired.
    Seeing that there are no further members wishing to ask 
questions, I want to thank each of you for being here today and 
for the knowledge and information that you have shared with us. 
It's very, very helpful.
    Before we conclude, I would like to ask for unanimous 
consent to submit the following document for the record--a 
letter from the Chemical Facility Anti-Terrorism Standards 
Coalition.
    Without objection, so ordered.
    [The information appears at the conclusion of the hearing]
    Mr. Harper. And pursuant to committee rules, I remind 
members that they have 10 business days to submit additional 
questions for the record, and should you get any of those 
questions I would ask that you submit your responses within 10 
business days from the receipt of such questions.
    Without objection, the subcommittee is adjourned.
    [Whereupon, at 12:44 p.m., the committee was adjourned.]
    [Material submitted for inclusion in the record follows:]
    [GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
    

                                 [all]