[Senate Hearing 115-477]
[From the U.S. Government Publishing Office]
S. Hrg. 115-477
EXAMINING THE CHEMICAL FACILITY
ANTI-TERRORISM STANDARDS PROGRAM
=======================================================================
ROUNDTABLE
BEFORE THE
COMMITTEE ON
HOMELAND SECURITY AND GOVERNMENTAL AFFAIRS
UNITED STATES SENATE
ONE HUNDRED FIFTEENTH CONGRESS
SECOND SESSION
__________
JUNE 12, 2018
__________
Available via the World Wide Web: http://www.govinfo.gov
Printed for the use of the
Committee on Homeland Security and Governmental Affairs
[GRAPHIC NOT AVAILABLE IN TIFF FORMAT]
U.S. GOVERNMENT PUBLISHING OFFICE
34-315 PDF WASHINGTON : 2019
-----------------------------------------------------------------------------------
For sale by the Superintendent of Documents, U.S. Government Publishing Office,
http://bookstore.gpo.gov. For more information, contact the GPO Customer Contact Center,
U.S. Government Publishing Office. Phone 202-512-1800, or 866-512-1800 (toll-free).E-mail,
gpo@custhelp.com.
COMMITTEE ON HOMELAND SECURITY AND GOVERNMENTAL AFFAIRS
RON JOHNSON, Wisconsin, Chairman
JOHN McCAIN, Arizona CLAIRE McCASKILL, Missouri
ROB PORTMAN, Ohio THOMAS R. CARPER, Delaware
RAND PAUL, Kentucky HEIDI HEITKAMP, North Dakota
JAMES LANKFORD, Oklahoma GARY C. PETERS, Michigan
MICHAEL B. ENZI, Wyoming MAGGIE HASSAN, New Hampshire
JOHN HOEVEN, North Dakota KAMALA D. HARRIS, California
STEVE DAINES, Montana DOUG JONES, Alabama
Christopher R. Hixon, Staff Director
Gabrielle D'Adamo Singer, Chief Counsel
Colleen E. Berny, Professional Staff Member
William G. Rhodes III, Fellow
Margaret E. Daum, Minority Staff Director
J. Jackson Eaton IV., Minority Senior Counsel
Julie G. Klein, Minority Professional Staff Member
Laura W. Kilbride, Chief Clerk
Bonni E. Dinerstein, Hearing Clerk
C O N T E N T S
------
Opening statements:
Page
Senator Johnson.............................................. 1
Senator McCaskill............................................ 2
Senator Peters............................................... 16
Senator Carper............................................... 19
Prepared statements:
Senator Johnson.............................................. 37
Senator McCaskill............................................ 38
WITNESSES
Tuesday, June 12, 2018
David Wulf, Acting Deputy Assistant Secretary for Infrastructure
Protection, National Protection and Programs Directorate, U.S.
Department of Homeland Security................................ 3
Christopher P. Currie, Director, Homeland Security and Justice
Team, U.S. Government Accountability Office.................... 5
Jesse LeGros, Jr., Vice President, Infrastructure Protection,
AFGE National Local #918....................................... 6
Jennifer Gibson, Vice President, Regulatory Affairs, National
Association of Chemical Distributors........................... 6
Randall Eppli, President and CEO, Columbus Chemical Industries,
Inc............................................................ 7
William Erny, Senior Director, American Chemistry Council........ 8
Justine Louchheim, Director, Government Affairs, The Fertilizer
Institute...................................................... 9
Linda Menendez, Director of Operations, Austin Powder Company.... 10
Debra S. Satkowiak, President, Institute of Makers of Explosives. 11
Alphabetical List of Witnesses
Currie Christopher P.:
Testimony.................................................... 5
Prepared statement........................................... 53
Eppli, Randall:
Testimony.................................................... 7
Prepared statement........................................... 67
Erny, William:
Testimony.................................................... 8
Prepared statement........................................... 73
Gibson, Jennifer:
Testimony.................................................... 6
Prepared statement........................................... 61
LeGros, Jesse Jr.:
Testimony.................................................... 6
Prepared statement........................................... 57
Louchheim, Justine:
Testimony.................................................... 9
Prepared statement........................................... 75
Menendez, Linda:
Testimony.................................................... 10
Prepared statement........................................... 80
Satkowiak, Debra S.:
Testimony.................................................... 11
Prepared statement........................................... 88
Wulf, David:
Testimony.................................................... 3
Prepared statement........................................... 41
APPENDIX
Statements submitted for the Record:
Agricultural Retailers Association........................... 98
Chamber of Commerce.......................................... 101
Environmental Technology Council............................. 103
National Association of Manufacturers........................ 107
Responses to post-hearing questions for the Record:
Mr. Wulf..................................................... 114
ROUNDTABLE EXAMINING THE CHEMICAL
FACILITY ANTI-TERRORISM STANDARDS PROGRAM
----------
TUESDAY, JUNE 12, 2018
U.S. Senate,
Committee on Homeland Security
and Governmental Affairs,
Washington, DC.
The Committee met, pursuant to notice, at 10:37 a.m., in
room 106, Dirksen Senate Office Building, Hon. Ron Johnson
presiding.
Present: Senators Johnson, McCaskill, Carper, Heitkamp,
Peters, Hassan, and Harris.
OPENING STATEMENT OF CHAIRMAN JOHNSON
Chairman Johnson. Good morning. This roundtable will come
to order. I want to thank everybody for your thoughtful
testimony and your time appearing here today.
This is an important issue. I will just consent to have my
written statement entered into the record.\1\ I do not want to
spend a whole lot of time because I would rather hear from you
folks. But as I have gone through the testimonies, we have gone
through this reauthorization once, and I really think it was a
pretty good attempt, in 2014, to take what was originally
authorized in 2007, recognize some of the problems with it and
address them, and there have been improvements made. I do not
think there is any doubt about it.
---------------------------------------------------------------------------
\1\ The prepared statement of Senator Johnson appears in the
Appendix on page 37.
---------------------------------------------------------------------------
We need to consider reauthorization for 2019. It sounds
like just about everybody here is in favor of authorization.
But I think there are some real serious issues we need to
discuss. And without upsetting the apple cart, without making
dramatic changes, anything we can do to streamline this, to
take advantage of what is already happening in other agencies.
Coming from a manufacturing background, I was talking to
the witnesses beforehand we extruded a very inert plastic, very
environmentally friendly, and yet we still had an Material
Safety Data Sheet (MSDS) book that thick. We had our local fire
department come in to do very detailed inspections, seeing what
kind of dangerous chemicals would certainly create a fire
hazard. We have the Bureau of Alcohol, Tobacco, Firearms and
Explosives (ATF) doing a pretty darn good job when you take a
look at the history of keeping explosives out of the hands of
people that have maligned intent.
So as much as possible you want to take advantage of other
governmental agencies. You want to design programs that are
very similar, to make them as identical as possible so industry
is not forced to really comply with the whims of multiple
masters. So that would be certainly my goal here in any kind of
reauthorization, is, again, not come up with something entirely
new but take a look at the current structure, look at the
improvements made from 2007 to 2014, and then moving forward
for reauthorization that is due in January 2019. What can we do
to further streamline this and take advantage of those other
opportunities? So that is kind of what I am hoping this
discussion will be about, and as we move forward over the next
few months, prior to reauthorization, we can work cooperatively
to achieve exactly that.
With that I will turn it over to my Ranking Member, Senator
McCaskill.
OPENING STATEMENT OF SENATOR MCCASKILL\1\
Senator McCaskill. I apologize to all of you. I went to the
wrong location.
---------------------------------------------------------------------------
\1\ The prepared statement of Senator McCaskill appears in the
Appendix on page 38.
---------------------------------------------------------------------------
Chemical Facility Anti-Terrorism Standards (CFATS) program,
initially began over a decade ago when Congress authorized it
in late 2006. It became operational shortly thereafter, in
2007. As it is clear from the name, the CFATS program is part
of our country's counter-terrorism efforts. It is designed to
secure facilities with hazardous chemicals, to reduce the
possibility of those chemicals being used in a terrorist
attack, as they were, for example, in the Oklahoma City
bombing.
CFATS uses a risk-based approach to determine which
facilities should be covered by the program. Facilities that
must comply with CFATS must manufacture or store at least 1 of
322 chemicals of interest, at or above a certain quantity and
concentration.
There are 18 risk-based performance standards (RBPS) that
facilities must implement, from securing the perimeter to
conducting background checks. However, it is up to each covered
facility to determine and implement the appropriate measures
that fit the unique needs of each facility. DHS does not
mandate that fences be built to a certain height, for example,
or that certain surveillance equipment must be used. The
program is intended to be flexible and tailored to each
facility.
Obviously, CFATS has had a rocky start. At one point, the
program faced an extensive inspection backlog, and as I
understand it, the U.S. Department of Homeland Security (DHS)
struggled to review the Site Security Plans (SSPs) in a timely
manner. These issues were compounded by the fact that for a
period of time, CFATS was authorized on a series of short-term
spending measures. That is not an ideal way to structure and
manage a regulatory program. It is very difficult for
businesses to comply with necessary regulations. It is even
more difficult if there is not certainty and predictability.
The concern that the program would lapse or that Congress
would dramatically change it prevented DHS from making long-
term adjustments to develop a sustainable and fair regulatory
regime. I am told by both DHS and many in industry alike that
the program has come a long way since it was reauthorized in
2014. We secured a 4-year authorization, which turned out to be
a game-changer. DHS had the space it needed to make adjustments
to the program and improve the experience for covered
facilities.
By all accounts, CFATS is now more streamlined, user-
friendly, and less cumbersome. Moreover, companies finally
received the regulatory certainty and stability they needed to
make lasting investments in the security of their facilities.
The current authorization expires in January 2019. I am
hopeful this roundtable will help us determine what aspects are
working well and where we need to make changes. Obviously, we
are all interested in addressing both gaps in the regulation
and further improving the program's applicability and
efficiency as it relates to how easy it is for private
businesses to manage.
Given the tight legislative schedule remaining, this
Committee has our work cut out for us to make sure CFATS does
not lapse and that we go back to the old days of nobody being
certain what is going to be or when it is going to be that.
I am confident that we can get it done in a way that
ensures we are keeping hazardous chemicals away from terrorists
while also allowing businesses and communities to thrive.
Thank you, Mr. Chairman. I look forward to hearing from our
roundtable participants.
Chairman Johnson. Thank you, Senator McCaskill. So we will
just go from my left to right, and we will start with David
Wulf, who currently serves as the Deputy Assistant Secretary
for Infrastructure Protection of the National Protection and
Programs Directorate (NPPD), U.S. Department of Homeland
Security. Mr. Wulf.
TESTIMONY OF DAVID WULF,\1\ ACTING DEPUTY ASSISTANT SECRETARY
FOR INFRASTRUCTURE PROTECTION OF THE NATIONAL PROTECTION AND
PROGRAMS DIRECTORATE, U.S. DEPARTMENT OF HOMELAND SECURITY
Mr. Wulf. Thank you, Mr. Chairman, thank you, Ranking
Member McCaskill and Members of the Committee.
---------------------------------------------------------------------------
\1\ The prepared statement of Mr. Wulf appears in the Appendix on
page 41.
---------------------------------------------------------------------------
I really appreciate the opportunity to be here to day to
provide an update on the progress of the Chemical Facility
Anti-Terrorism Standards program, the progress we continue to
make in fostering security at America's highest-risk chemical
facilities.
When I last testified before this Committee I emphasized
the importance of long-term authorization for this critical
anti-terrorism program, and am very grateful for the leadership
the Committee demonstrated in security the 4-year CFATS
authorization that was signed into law in December 2014.
As we now find ourselves nearly 3\1/2\ years into the
authorization period, I am grateful that the Committee is again
taking the lead to continue long-term authorization of CFATS,
and maybe even give some thought to permanent authorization.
Just a thought.
As I am sure you will hear me say once or twice today, the
stability that has come along with long-term authorization has
driven unprecedented progress as we have worked with CFATS-
covered facilities to make America's high-risk chemical
infrastructure a truly hard target, with literally tens of
thousands of security measures having been put into place at
high-risk facilities across the country.
The stability afforded by long-term authorization has
facilitated our planning and execution of important
programmatic improvements while it has also afforded regulated
industry stakeholders with the certainty that they deserved as
they planned for and made significant investments in CFATS-
related security measures.
I do also want to take this opportunity to thank the
Committee for including, in the recent DHS authorization bill
legislation that would transform our parent organization, the
National Protection and Programs Directorate, into the
Cybersecurity and Infrastructure Security Agency (CISA). This
new agency would continue NPPD's mission of leading the
national effort to improve critical infrastructure security,
coordinating the protection of the Federal Government's
networks and physical infrastructure, and helping entities
across the public and private sectors to manage potential cyber
risks. As the threats facing our national security grow and
evolve every day, we look forward to continuing to work with
this Committee to pass that critical legislation.
Turning back to CFATS, as we are all too aware, the threat
of chemical terrorism remains a real and very relevant one.
Around the globe, we continue to see bad actors seeking to
acquire and using in attacks chemicals of the sort that trigger
coverage under CFATS, and the threat stream continues to
reflect that chemical facilities themselves remain an
attractive target for terrorists. So I can tell you with
certainty that the work we are doing in concert with our
committed stakeholders across the wide variety of industries
and facilities that comprise the CFATS-regulated universe is
making a real difference in protecting this Nation.
And having had the opportunity to work closely with my
counterparts in other countries, I can absolutely tell you that
what we are doing here, in the United States, through CFATS,
what you have helped us to build with your support for long-
term authorization, is absolutely the envy of the world. With
its 18 comprehensive risk-based performance standards and it is
non-prescriptive, flexible approach, CFATS is well suited to
enhancing security across the very diverse universe of high-
risk chemical facilities.
So what have we been doing to make CFATS even stronger as
we have enjoyed the stability of long-term authorization over
the past 3\1/2\ years? Well, we have improved processes and
have seen unprecedented progress in the pace of inspections and
in the review and approval of facility site security plans,
eliminating a backlog of security plan reviews 6 years ahead of
earlier Government Accountability Office (GAO) projections. We
have developed and launched an improved risk assessment
methodology that effectively accounts for all relevant elements
of risk and have reassessed the level of risk associated with
nearly 30,000 facilities across the Nation.
We have implemented the CFATS Personal Surety Program,
affording the highest tier at CFATS-covered facility, the
ability to ensure that individuals with access to those
facilities have been vetted for terrorist ties, and we have
significantly reduced burden across our stakeholder community,
having built and launched a streamlined, more user-friendly
suite of online tools through which facilities submit risk
assessment or top-screen surveys and develop their site
security plans.
So I have probably gone a minute or two long so my
apologies for that, Mr. Chairman. But in closing, and just to
finish on a positive note, I would like to again thank this
Committee and your top-notch staff for your leadership in the
CFATS reauthorization process. We are very fond of saying that
chemical security is a shared commitment and not unlike the
role of our industry stakeholders who have embraced and built
this program in so many ways, and the role of our committed and
very talented team at DHS. The role of Congress, the role of
this Committee in shaping and authorizing CFATS for the long-
term has been hugely important, and I am looking forward to
working further with you as we drive toward reauthorization
this year.
So thank you very much. I look forward to the dialog here
today.
Chairman Johnson. Thank you, Mr. Wulf. Now, of course,
everybody knows that that was just a bluff about the length of
time.
Mr. Wulf. Sorry about that.
Chairman Johnson. Our next witness is Christopher Currie.
Mr. Currie currently serves as the Director of Emergency
Management, National Preparedness, and Critical Infrastructure
Protection, Homeland Security and Justice Team, U.S. Government
Accountability Office. Mr. Currie.
TESTIMONY OF CHRISTOPHER P. CURRIE,\1\ DIRECTOR, HOMELAND
SECURITY AND JUSTICE TEAM, U.S. GOVERNMENT ACCOUNTABILITY
OFFICE
Mr. Currie. Thank you very much, Mr. Chairman, Ranking
Member McCaskill. As you said, I work for GAO. We have been
assessing this program for almost a decade now. After about a
billion dollars in taxpayer money spent, and more by the
industry on the panel, numerous GAO recommendations, and
heavy--and I emphasize heavy--oversight by Congress, the CFATS
program has addressed many management challenges it faced early
on.
---------------------------------------------------------------------------
\1\ The prepared statement of Mr. Currie appears in the Appendix on
page 53.
---------------------------------------------------------------------------
However, just fixing the past problems is not enough today.
As Congress considers reauthorization there are other issues, I
think, need to be discussed here. Some of these are addressed
in our past work, others are addressed in our ongoing work that
we will issue later this summer, and others, I think, warrant
conditional attention as we move forward and continue to
evaluate this program, even if it is reauthorized.
First, the purpose of security regulations is to improve
security. It is critical that the program be able to measure
how risks are being reduced and not just focus on outputs, like
inspection numbers.
Second, the program has to evolve with new threats, like
cyber and staff need and training awareness to help these
facilities evolve with the threats.
Third, first responders, as you mentioned, the fire
departments and others like that, need to know what they are
responding to and how to address it at these facilities. A
balance must be struck between sharing information with the
communities and protecting security.
Last, in such a regulated industry as this, the Federal
Government should look for opportunities and efficiencies to
leverage multiple regulatory programs as well.
Thank you very much, and I look forward to the discussion.
Chairman Johnson. Thank you, Mr. Currie.
Our next witness is Jesse LeGros. Mr. LeGros is the Acting
Vice President of Infrastructure Personnel at the American
Federation of Governmental Employees (AFGE) National Local 918.
Mr. LeGros also serves as a CFATS chemical security inspector
for the Department of Homeland Security. Mr. LeGros.
TESTIMONY OF JESSE LEGROS, JR.,\1\ VICE PRESIDENT,
INFRASTRUCTURE PROTECTION, AFGE NATIONAL LOCAL #918
Mr. LeGros. Thank you, Chairman. I will be pretty quick on
mine. I am one of the original chemical security inspectors
that was detailed from Federal Protective Service (FPS) over,
so I have been here through the good, the bad, the ugly, if you
will. CFATS is a good regulation and it needs to be
reauthorized. However, it needs to be an appropriate
regulation, not a continuing one.
---------------------------------------------------------------------------
\1\ The prepared statement of Mr. LeGros appears in the Appendix on
page 57.
---------------------------------------------------------------------------
Having said that, the main reason for me being here is to
talk about the training issues, specifically in the cyber, or
the lack of the cyber training that we are getting. With cyber
being such a forefront issue, it is hard for us to, as
inspectors, to regulate cyber issues at a facility when we have
not had any substantive training on cyber.
I give my time back to the Director so he has extra.
Chairman Johnson. I appreciate that.
Our next witness is Jennifer Gibson. Ms. Gibson is the Vice
President of Regulatory Affairs at the National Association of
Chemical Distributors (NACD). Ms. Gibson.
TESTIMONY OF JENNIFER GIBSON,\2\ VICE PRESIDENT, REGULATORY
AFFAIRS, NATIONAL ASSOCIATION OF CHEMICAL DISTRIBUTORS
Ms. Gibson. Good morning, Mr. Chairman, Ranking Member
McCaskill, and Committee Members. Thank you so much for
inviting NACD to participate in this roundtable today.
---------------------------------------------------------------------------
\2\ The prepared statement of Ms. Gibson appears in the Appendix on
page 61.
---------------------------------------------------------------------------
NACD and our over 440 member companies are vital to the
chemical supply chain, providing products to over 750,000 end
users. NACD members are leaders in health, safety, security,
and environmental performance through implementation of
Responsible Distribution, established in 1991 as a condition of
membership in a third-party-verified management practice.
While security has always been an inherent element of
Responsible Distribution, after the September 11th terrorist
attacks, NACD added specific security elements to the program
and we continue to enhance these requirements.
Chemical distribution is also a very highly regulated
industry, as you can imagine, and that being said we are very
strong supporters of the CFATS program. I will tell you why.
Unlike some other agencies, DHS has taken a very collaborative
approach in implementing CFATS. Rather than coming in with a
find-and-fine mentality, as many agencies do, inspectors and
headquarters staff alike have had very productive conversations
with the industry, the regulated community, with the ultimate
goal of improving security. This has led to greater
efficiencies such as the development of alternative security
programs, which allow facilities to really take advantage of
other measures that they have in place, both regulatory and
through industry programs such as Responsible Distribution.
A long-term CFATS reauthorization will provide stability
for both industry and DHS. Industry has made substantial
investments in CFATS and a long-term reauthorization will give
companies the certainty that this will continue and those
investments were worthwhile. It will also allow DHS to continue
to build on the program efficiencies that they achieved
following the 2014 reauthorization.
So NACD strongly supports a long-term authorization of
CFATS and we look forward to our discussion today.
Chairman Johnson. Thank you, Ms. Gibson.
Our next witness is Randall Eppli. Mr. Randall is the
President and Chief Executive Officer (CEO) of Columbus
Chemical Industries (CCI), headquartered in Columbus,
Wisconsin. Mr. Eppli.
TESTIMONY OF RANDALL EPPLI,\1\ PRESIDENT AND CEO, COLUMBUS
CHEMICAL INDUSTRIES, INC.
Mr. Eppli. Good morning, Chairman Johnson, Ranking Member
McCaskill, and distinguished Members of this Committee.
---------------------------------------------------------------------------
\1\ The prepared statement of Mr. Eppli appears in the Appendix on
page 67.
---------------------------------------------------------------------------
Columbus Chemical Industries is a chemical distributor
headquartered in Columbus, Wisconsin, and as Senator Johnson
indicated, we are about 20 minutes outside of Madison. I want
to thank you for allowing me to participate in this important
roundtable and I am pleased to provide input to the CFATS
program.
CCI is a 40-year-old, family owned manufacturer and
distributor of chemicals and chemical solutions for industries
such as semiconductor, medical device, pharmaceutical,
laboratory, and various other applications. CCI is a small
business. Our 70-person team serves customers throughout North
America, Europe, and Asia, from our facility in Wisconsin and
our facility in Phoenix, Arizona. We have been an active member
of the National Association of Chemical Distributors for 25
years.
From the beginning, DHS generally took a non-adversarial,
consultative and reasonable approach in implementing the CFATS
regulations. It has been our experience that the DHS staff, in
both the field and at headquarters, have generally been
knowledgeable, professional, and courteous. Additionally, we
have appreciated that DHS arranges their site visits with us in
advance, unlike many other government agencies.
I believe the CFATS program has made the chemical industry
and our Nation more secure. Since the program's establishment
in 2007, we have invested significant capital and training
resources toward enhanced security measures at our facilities.
While these resources did not necessarily help us improve our
business or grow our business, they were nonetheless important
to ensure the security of my company, of our employees, and the
community.
CCI, as a company, supports the long-term authorization of
CFATS. Thank you.
Chairman Johnson. Thank you, Mr. Eppli.
Our next witness is William Erny. Mr. Erny currently serves
as Senior Director at the American Chemistry Council (ACC).
TESTIMONY OF WILLIAM ERNY,\1\ SENIOR DIRECTOR, AMERICAN
CHEMISTRY COUNCIL
Mr. Erny. Thank you, Chairman, Ranking Member, and other
Members of the Committee.
---------------------------------------------------------------------------
\1\ The prepared statement of Mr. Erny appears in the Appendix on
page 73.
---------------------------------------------------------------------------
So I am a Senior Director with America Chemistry Council
and ACC represents the major chemical producers across the
United States, all of which are involved in the business of
chemistry. The business of chemistry is a $760 billion
enterprise and we are growing. We support roughly 800,000 jobs
across the United States, good-paying, skilled, American jobs.
And it is because of our role in the economy chemical security
is a top priority for ACC and our members.
This year marks the 30th anniversary of ACC's Responsible
Care Program. Responsible Care is the leading chemical industry
stewardship program and it has become the gold standard in the
industry. It is international in scope and serves as a model
for regulatory programs. ACC members have invested more than
$17 billion in security under the program.
ACC also supports long-term authorization of the CFATS
program. We agreed that DHS, over the past 4 years, has really
made some significant strides and improvements in implementing
the program, and I think this is mostly as a result of their
demonstrated commitment to listen and work with the regulated
community in a collaborative fashion.
And while DHS has made some significant progress, ACC would
like to throw out several recommendations for additional
improvement. The first is they need to improve the transparency
in their DHS risk-tiering determinations. Second, we need to
eliminate the requirement for terrorist screen at these lower-
risk Tier 3 and 4 sites. And third, we need to establish a
CFATS recognition program that provides regulatory recognition
for responsible operators that go above and beyond mere
regulatory compliance.
In closing, CFATS has helped make our industry and our
community safer and more secure. We encourage the Committee to
consider these proposed changes and to reauthorize the program.
Doing so will provide the needed regulatory certainty and
stability for companies to make long-term investments and sound
risk management decisions.
Thank you and I look forward to our future discussions.
Chairman Johnson. Thank you, Mr. Erny.
Our next witness is Justin Louchheim. Mr. Louchheim is the
Director of Governmental Affairs at The Fertilizer Institute
(TFI). Mr. Louchheim.
TESTIMONY OF JUSTIN LOUCHHEIM,\1\ DIRECTOR, GOVERNMENT AFFAIRS,
THE FERTILIZER INSTITUTE
Mr. Louchheim. Thank you. Good morning, Chairman Johnson,
Ranking Member McCaskill, Members of the Committee. My name is
Justin Louchheim. I work for The Fertilizer Institute. TFI
represents the Nation's fertilizer industry, which includes
companies that are engaged in all aspects of the fertilizer
supply chain. This ranges from large production facilities to
thousands of small agricultural retailers.
---------------------------------------------------------------------------
\1\ The prepared statement of Mr. Louchheim appears in the Appendix
on page 75.
---------------------------------------------------------------------------
So in terms of how we fit into the program, Dave, down the
table, is going to tell me I am wrong in a second, but DHS
estimates that there is about 3,500 facilities presently
subject to CFATS program. TFI estimates that this includes
about 1,500 fertilizer manufacturers and agricultural retail
facilities, with the retail facilities accounting for the
overwhelming majority.
Retail facilities typically are generally located in rural
communities, interface directly with farmers, typically employ
about 5 to 10 individuals per facility. So safe and secure
handling of fertilizers is top priority for The Fertilizer
Institute and our members. We actively participate, sponsor
numerous safety initiatives. One example is ResponsibleAg. Mr.
Erny talked about stewardship programs. ResponsibleAg would be
our stewardship program. This exists to enhance compliance for
agricultural retailers with a variety of Federal regulations.
To date we have about 2,500 facilities registered with the
ResponsibleAg program, over 1,000 facilities certified, 185
auditors have been trained, and about 2,000 audits have been
completed. I am very proud of this industry stewardship program
and invite you and your staff to come out and visit any time.
So regarding the CFATS program, our members support the
program. We recognize its importance and we would support a
multi-year reauthorization.
A couple of thought about where we could go forward. We
have heard transparency talked about. That would be at the top
of my list. We believe that implementation of the program will
benefit from a bit more transparency between DHS and the
regulated community. This includes the re-tiering process for
facilities and chemicals covered under Appendix A. We think
ultimately this will bolster the quality of site security plans
around the country.
Information sharing. We believe facility owner-operators
should retain the discretion to determine how site security
plans and related information is shared. I think that is very
important. And then we have heard this discussed previously,
the Personal Surety Program. We do not believe this obligation
to check employee records against the terrorist screening
database (TSDB) should currently be expanded to facilities and
risk groups at Tier 3 and 4. Just in terms of numbers, this is
a huge expansion of that program. Currently you have about less
than 200 in Tiers 1 and 2 facilities, your most sort of at-risk
facilities. To take it to 3 and 4 would take it from that 200
to about 3,500.
So we think if we want to look at this, perhaps a study
would be a step to see if this makes sense, to see how it has
worked for Tiers 1 and 2 first, before we expand it a great
deal. Thank you.
Chairman Johnson. Just a real quick question. Of your
members, how many are Tier 1, 2, 3, and 4? Do you have a
breakdown on that?
Mr. Louchheim. Yes.
Chairman Johnson. Like are all the retail stores, are they
Tier 4?
Mr. Louchheim. Sure. I want to follow up in writing to make
sure I am certain of this, but it would be, we are talking
about 1,500 manufacturer retail facilities for the fertilizer
industry at large. I would say about 1,400 of those are
agricultural retailers. The bulk of those are going to be 3 and
4, those 1,400.
Chairman Johnson. OK. Thank you, Mr. Louchheim.
Our next witness is Linda Menendez. Ms. Menendez is the
Director of Operations for Austin Powder Company, headquartered
in Cleveland, Ohio. Ms. Menendez.
TESTIMONY OF LINDA MENENDEZ,\1\ DIRECTOR OF OPERATIONS, AUSTIN
POWDER COMPANY
Ms. Menendez. Chairman Johnson, Ranking Member McCaskill,
and Members of the Committee, on behalf of Austin Powder
Company thank you for the opportunity to discuss the CFATS
program and how this program can be improved.
---------------------------------------------------------------------------
\1\ The prepared statement of Ms. Menendez appears in the Appendix
on page 80.
---------------------------------------------------------------------------
My name is Linda Menendez. I am the Director of Operations
for Austin Powder Company, a 185-year-old privately held
commercial explosives manufacturer headquartered in Cleveland,
Ohio. I have worked for Austin Powder for over 30 years, 10
years in the field operations.
As you are aware, commercial explosives are used today in
mining, quarry, construction, pipeline trenching, avalanche
prevention, and the like. Commercial explosives play a
significant role in improving our quality of life. Our license
to operate our sites is based on our compliance with the
regulations of ATF. Not only do I represent Austin Powder
Company, I also represent the boots on the ground, Austin
Powder's 1,200 employees, cleared by ATF as employee possessors
or responsible persons, transporting and using explosives
daily. Our employees are critical contributors to our safety,
security, and compliance.
It has been my experience that persons responsible to
direct the management of an ATF-licensed facility rely on this
orange book, 27 Code of Federal Regulation (CFR) 555, to plan
their sites and comply with ATF regulations for the safe and
secure storage of explosives.
My testimony today addresses the following points.
First, additional regulations under the CFATS program for
the same products, for the same purpose has resulted in
additional expense and time and money without benefit. An
example of this is one of our ATF-licensed facilities, a
guarded former Navy ammunition depot with bunker-type military
constructed magazines, required to install additional fencing,
cameras, and monitor detection devices with over a cost of
$300,000.
Second, duplicative regulation really detracts the
compliance efforts of those seeking to be confident that they
understand these laws.
As you reconsider the reauthorization of CFATS, I urge you
to evaluate the overlapping burden placed on the explosives
industry and exclude ATF federally licensed facilities from the
CFATS bill. Thank you.
Chairman Johnson. Thank you, Ms. Menendez.
Let me just quickly ask you a question. Did you fight for
that in the original authorization and the 2014
reauthorization? Did you fight to be excluded?
Ms. Menendez. Yes, we did.
Chairman Johnson. You fought it and lost.
Ms. Menendez. And lost.
Chairman Johnson. OK.
Our next and final witness is Debra Satkowiak?
Ms. Satkowiak. Yes. Good morning.
Chairman Johnson. Ms. Satkowiak currently serves as the
President of the Institute of Makers of Explosives (IME). Ms.
Satkowiak.
TESTIMONY OF DEBRA S. SATKOWIAK,\1\ PRESIDENT, INSTITUTE OF
MAKERS OF EXPLOSIVES
Ms. Satkowiak. Thank you. Chairman Johnson, Ranking Member
McCaskill, and Members of the Committee, on behalf of the
Institute of Makers of Explosives and the commercial explosives
industry, thank you for the opportunity to discuss DHS CFATS
and to be part of the process to improve the program.
---------------------------------------------------------------------------
\1\ The prepared statement of Ms. Satkowiak appears in the Appendix
on page 88.
---------------------------------------------------------------------------
My name is Debra Satkowiak and I am the President of IME.
Our association was founded in 1913, at the request of the U.S.
Government, to develop industry best practices and to promote
explosive safety. To this day, we remain the safety and
security association for the commercial explosives industry.
Over 5 billion pounds of explosives materials are consumed
in the United States annually in the operations that Linda just
recently mentioned. Explosives underpin our economy, and as
Linda said, they improve and they keep us in the quality of
life that we have today. IME is proud of our industry's safety
and security record and we continuously work with our member
company experts to improve our best practices, many of which
are adopted into regulation by Federal, State, and local
entities. We also work closely with those government agencies
that regulate us to keep explosives out of the hands of those
who would do us harm.
My testimony addresses the following points.
First, duplicative regulations. IME members are regulated
by ATF and the DHS CFATS programs for precisely the same
purpose, to prevent theft and diversion of explosives. There
has been no justification provided for the duplication of DHS
over ATF's jurisdiction.
Second, the millions spent on CFATS compliance by IME
members have not had a measurable impact on security, according
to the U.S. Government data.
Third, CFATS duplicative regulations have caused conflict
with other Federal regulations, leaving our members to de-
conflict and clarify jurisdictional and policy interpretations.
Finally, the lack of transparency in CFATS' tiering impedes
the ability of businesses to proactively plan and adapt
operations.
As a solution to the duplicative regulations, IME is
requesting that ATF be given the same deference as U.S. Coast
Guard (USCG), the Departments of Defense (DOD) and Energy
(DOE), and the Nuclear Regulatory Commission (NRC) in the CFATS
statutory exemptions.
In closing, IME is not against regulation. Indeed, in the
world of commercial explosives, smart regulation promotes good
business. We only seek relief from redundant regulation.
Thank you once again, and I look forward to answering your
questions and being a resource for the Committee.
And I do have to quickly take one moment to correct our
written testimony, to adjust the hours estimated to complete a
Top-Screen in accordance with the GAO's 6-hour estimate and the
update to the IME member company time spent that is mentioned
in our testimony to 357 hours to fill out Top-Screens for their
facilities.
Chairman Johnson. OK. I appreciate that and we will have
the staff make that correction.
Again, I am here for the duration so what I will do is turn
it over to our Ranking Member for questions first. But let me,
so I do not forget, I do want to commend DHS. I think it is a
really positive sign the number of businesses saying that you
have approached this very cooperatively. I just think that is
the best way to go, whether it is Occupational Safety and
Health Administration (OSHA) or Environmental Protection Agency
(EPA) or, in this case, DHS with CFATS. Businesses also want a
secure America, and doing it cooperatively, I think, is just
going to absolutely get the best results.
So I really do appreciate hearing the fact that that is the
way DHS has approached this, and I would encourage you to
continue along that path.
Mr. Wulf. Absolutely.
Chairman Johnson. With that, Senator McCaskill.
Senator McCaskill. Sure. Just briefly a few questions for
everyone. Just raise your hand if you disagree. CFATS should be
reauthorized. Anybody think it should not be? Raise your hand
if you think we should not reauthorize CFATS.
OK. If you would go down the panel and give me an ideal
length of time you think it should be reauthorized for.
Mr. Wulf.
Mr. Wulf. We would certainly prefer a permanent
reauthorization, though recognizing the progress of permanent
is not in the cards, we would be hoping for something
significantly longer than the 4-years we received in 2014, so
10 years.
Senator McCaskill. Mr. Currie.
Mr. Currie. All right, ma'am. From GAO's perspective, and
we do not have an opinion, but I will say I can understand the
benefits of having permanent reauthorization. It makes some
sense for predictability and budgeting. However, I do think
that the consistent reauthorizations every 4 years have brought
a lot of additional oversight that have, frankly, improved the
program. I think that is a big reason for the improvements.
Senator McCaskill. Mr. LeGros.
Mr. LeGros. I agree with the Director, permanent, and I
disagree with GAO as far as the oversight, because I think, as
any legislation, you can always have the governmental oversight
no matter what the timeframe is on the regulation.
Senator McCaskill. Ms. Gibson.
Ms. Gibson. NACD would support a multi-year
reauthorization, somewhere between 5 and 7 years.
Senator McCaskill. OK. Mr. Eppli.
Mr. Eppli. A minimum of 4 years.
Senator McCaskill. Minimum of 4 years.
Chairman Johnson. What about maximum? I think it is
interesting. The industry all of a sudden went from five to
seven. I mean, do you also agree that reauthorization is
important?
Mr. Eppli. I do. The concern I would have is if it is
permanent, is there a chance to do the kind of thing we are
doing here today to re-evaluate.
Senator McCaskill. OK.
Mr. Erny. Yes, I would agree, and we think the oversight
function here is really important. So to the extent that we can
continue to have these discussions, I would say ACC would
support a longer-term authorization, minimum of 4 years.
Senator McCaskill. But what would be the longest you think
would still be good without being counterproductive to
oversight?
Mr. Erny. Right. I will just be frank. I think it depends
on if we can see some of the changes made to the program that
we are talking about here today, to help better streamline
this, remove some of the regulatory burden associated on the
regulatory community.
Senator McCaskill. OK.
Mr. Erny. So I think it all depends.
Senator McCaskill. OK.
Mr. Louchheim. Thank you for the question. I would say,
similar to some of the other comments, 4 to 6 years. I would
probably prefer if we could get to an--whatever authorization
period is, that we can get to an off-election year, for when it
needs to be revised.
Senator McCaskill. They all want everything to be in an
off-election year. Trust me when I say that. Ms. Menendez.
Ms. Menendez. Thank you. I believe that the reauthorization
should be a 4-year period, as long as duplicative regulations
are removed.
Ms. Satkowiak. Yes, of course. Assuming that ATF-regulated
facilities are exempted from the program, we would support 4-
year reauthorization.
Senator McCaskill. OK. Is there anyone who would like to
speak up and say that some of the chemicals that we are
regulating here should be removed from the list? Does everyone
agree that chlorine, hydrogen fluoride, and ammonia nitrate
should stay on the list? Does anybody disagree with that?
[No response.]
OK. What is your analysis, Director Currie, of the
facilities communication and planning with local first
responders as it stands today?
Mr. Currie. Yes. That is something we are addressing and we
will be reporting on later this summer. But what I can tell
you, preliminarily, is that--I mean, the CFATS program has done
a lot, when they go out and do inspections, to verify that the
facilities are working with the local emergency planning
community, so that is the formal mechanism.
What we are looking at, though, is do first responders--the
firefighters, the policemen--do they have access to everything
that is at that facility? That is our biggest concern right
now, from a safety perspective. I mean, real-world incidents
have shown that people have died responding to things that they
were not prepared to respond to.
So we are looking at what DHS is doing, how they are
working with EPA, how they are working with the States to
figure out, do responders know exactly what is at that facility
beforehand.
Senator McCaskill. For any of the actual people who have
companies that are here, thinking that it is too duplicative,
is there anything specifically as it relates to first
responders' responsibilities and their role in this that you
would like to see changed? Ms. Menendez.
Ms. Menendez. Thank you. We always reach out to our local
responders. We are in their remote areas. Most of our first
responders are volunteers. We had one instance where one of our
managers, trying to reach out to a local fire department, said
the only way to get their attention is to call 911. So that is
really what we are dealing with, is that you have very remote
facilities with volunteer organizations that are not available
to spend the time to understand what chemicals are in their
back yards.
Senator McCaskill. Is this common among the explosives
industry, that you are in remote areas?
Ms. Menendez. Yes, it is.
Senator McCaskill. Because of the nature of what you do.
Chairman Johnson. That is a good thing.
Senator McCaskill. And that is a good thing, but it is also
a big challenge for first responders. First of all, volunteer
departments, in terms of the resources for training and the
applicability of all of the technical knowledge that you would
have to have here. That is really a challenge. I think that is
something that we need to take a look at. Thank you.
Ms. Satkowiak. Senator, if I may add to that.
Senator McCaskill. Sure.
Ms. Satkowiak. ATF requires that we notify the first
responders, the fire authority, where we have explosives
storage, because it is important to us that those first
responders know where our materials are. However, on the flip
side, for security proposes, we do not want the general public
to know where explosives are stored. And IME, as an
association, we are asking ATF to make sure that that
notification to the local fire authorities is done on an annual
basis, and ATF has taken up that rulemaking on our behalf.
Senator McCaskill. OK. Thank you, Mr. Chairman.
Chairman Johnson. Before I go to Senator Heitkamp, you
asked about ammonium nitrate. Mr. Louchheim, you made the
distinction between ammonium nitrate and urea ammonium nitrate
(UAN). Correct? Can you talk about the distinction and how big
a difference that is, and how big a problem that is if we
maintain urea ammonium nitrate under CFATS?
Mr. Louchheim. Sure. Thank you for that. So ammonium
nitrate would be more in prill solid form. Urea ammonium
nitrate would be a liquid. Those are the key sort of physical,
how you see it, differences.
Yes, in the written testimony we sort of make some
reference to some of this. So a little bit of background, I
guess, is probably relevant for here. It is a little outside
the scope of CFATS in some of this background here. DHS had
this obligation still on the books to create a track-and-trace
program for ammonium nitrate, purchase of ammonium nitrate.
This is a decades-old directive from Congress. It has not yet
been implemented.
Sort of along the lines of this directive they, last year,
commissioned a study by the National Academy of Sciences (NAS)
to more broadly explore the use of improvised explosive
chemicals and make recommendations on how they should be
managed in commerce.
So the NAS issued a report in late 2017. They identified 28
chemicals for further consideration by DHS. One such chemical
is urea ammonium nitrate, which is a liquid form. It is a
widely used fertilizer. TFI believes that this product was a
little mischaracterized as in the highest-risk category in this
report, and one of our reasons is it has never been used as an
explosive.
And, so our focus here is we think DHS should focus its
limited resources on those chemicals that have historically
been used.
Chairman Johnson. Tell me why that is a problem, and then I
want somebody to either confirm what he is saying or defend why
we would continue to regulate it under CFATS. Does it
essentially put retailers into Tier 1 position? Or, what is the
problem here?
Mr. Louchheim. Part of the problem is, depending on what
you are trying to track and trace. I guess, you could try to
track and trace everything out there in the world, right? And,
you can only track and trace so much.
UAN is very widely used. Ammonium nitrate is sort of a
shadow of what it once was in terms of usage and consumption
right now by farmers. It has a valuable environmental role, as
a fertilizer for crops, but its use is not what it used to be.
And so UAN, being so widely used, would be a serious challenge
to implement.
Chairman Johnson. So you are saying urea ammonium nitrate
is not a problem. It is not a dangerous chemical.
Mr. Louchheim. And it is also never been used.
Chairman Johnson. Does anybody want to confirm that or
challenge that?
Mr. Wulf. So if I could, Mr. Chairman. So urea ammonium
nitrate liquid is not regulated--is not covered under CFATS
right now, so I think what Justin is referring to is and he
mentioned a separate framework that we were asked to put into
place under the secure handling of ammonium nitrate provisions
of the 2008 Appropriations Act.
And, I think this, in many ways, is a good government
story. So what the law asked us to try to do was to put in
place a regulatory framework specific to ammonium nitrate that
would have required registration and vetting against the
terrorist screening database of all purchasers and sellers of
ammonium nitrate. And we worked through the rulemaking
progress. We pushed out notices of proposed rulemaking (NPR),
did the whole notice and comment process. But we could not
arrive at a proposed final rule that, in our view, struck an
appropriate balance between cost and benefits and, importantly,
the burdens that would have accrued to potentially regulated
industry.
So unlike CFATS, which is a facility security-focused
regulatory framework, this would have been, or this would be a
framework focused on commerce in ammonium nitrate, on the
purchase and sale of ammonium nitrate. Our view is that in as
much as ammonium nitrate is one of perhaps a dozen high-threat
improvised explosive device (IED) precursor chemicals, it would
not make sense to implement such a burdensome regulatory scheme
for a single chemical.
So what we did, we came to Congress, we talked with our
industry stakeholders, and we are looking at a fresh start
here, and that is why we sponsored this National Academy of
Sciences study. And so that is the document to which Justin is
referring. And so their recommendation was that urea ammonium
nitrate is a chemical with which we should be concerned going
forward. It is probably another discussion for another day.
But, we are very open to that feedback. And those are
recommendations from the National Academy.
Chairman Johnson. So you are just trying to head something
off at the pass. OK.
Mr. Wulf. Yes.
Chairman Johnson. Senator Heitkamp. Oh, sorry about that.
Senator Peters.
OPENING STATEMENT OF SENATOR PETERS
Senator Peters. Thank you, Mr. Chairman.
A question I have is related to cybersecurity threat. Mr.
Currie, you mentioned that in your comments. Mr. LeGros, you
did as well. Certainly when we are talking about critical
infrastructure here and potentially dangerous chemicals that
are being produced, and we all have to agree that cyber is a
major threat to that. I would like to have both of you talk a
little bit more about that, deficiencies that currently exist,
things that we may be thinking about.
Mr. Currie, if you could elaborate on your comments. My
understanding is that a lot of these facilities do not have
full-time folks on staff. Often it is contracted out. It may
not have the kind of intensity of supervision that is necessary
to make sure that these sites are secure. But if you could tell
us a little bit about more of your findings, what you think we
should be doing, and then, Mr. LeGros, talk about the
inspectors. You mentioned that in your testimony as well.
Mr. Currie. Sure. I can start. I agree with you. This is a
huge concern. It is not something that we have specifically
studied or drilled down into in the CFATS program, although we
have been working with staff on the Committee to do some future
work.
But I would just say that building cybersecurity expertise
in the training is a huge challenge across all critical
infrastructure sectors. It is a huge challenge at DHS in
general, for them to just recruit and retain cyber
professionals in their primary cyber missions, let alone
getting inspectors trained. So I think you are absolutely
right. This is something that we need to focus on, on this
program, or else it is not going to be able to continue to
evolve to address what is probably growing to be the biggest
security challenge these facilities are going to face.
Senator Peters. Mr. LeGros.
Mr. LeGros. And I agree. Understand, I am not a cyber
expert, by no means. I am more of a physical security expert.
So back as far as the cyber goes, it depends on the facility.
Cyber is what it is. It refers to everything in our daily
lives. But on one side, as far as the CFATS go, a lot of times
what we call chemical of interest (COI), has no cyber functions
with it. A good example is like chlorine. A lot of facilities
use chlorine to treat the water. It is basically a manual
system, a standalone. They hook it up, they turn on the valve,
and as the water goes by it sucks the chlorine out.
So from that standpoint, under the CFATS, it is not really
a cyber issue. However, it is being made into it because now
headquarters is looking at emails, the other processes that a
facility does. Because a facility could have five chemicals.
Four of them, or all five of them be chemicals of interest
under our regulation. However, they are not tiered for those
other four chemicals. They are only tiered, like in this case,
for the chlorine.
So if DHS, with CFATS inspectors, are going to look more at
the cyber section of it, we, the inspectors, have to have valid
training, not what we have had in the past as far as training,
which is basically how to fill out our inspection reports in
order for it to get approved up to headquarters.
Senator Peters. Mr. Wulf, do you want to comment, your
thoughts on this matter?
Mr. Wulf. Sure. Yes, I appreciate the opportunity. So cyber
is certainly an important concern across the chemical sector,
really across all 16 of our critical infrastructure sectors. In
the chemical sector, as Jay alluded to, you see varying degrees
of integration of cyber systems, with chemical processes, with
facility security networks. And so, we have varying degrees of
engagement on the cyber front.
All of our inspectors are equipped to engage and address
our risk-based performance standard focused on cybersecurity at
the facilities where we have what we call minimal integration
of cyber systems, where cyber systems are basically used to run
the email but are not connected to the processes involving the
chemicals, they are not connected to the facility's security
system, closed-circuit TV, or what have you.
We have done some advanced training for about half of our
inspector cadre, equipping them to get out and inspect the more
fully integrated facilities and their cyber systems and to work
with facilities as they think through ways in which they can
better secure those cyber systems. We have cyber subject matter
experts in our headquarters office who are available to work
with inspectors, who tee up the questions that should be asked,
based upon their review of facility site security plans.
So cyber very much at the top of our minds, and I think in
many ways CFATS is at kind of the leading edge of cybersecurity
in putting into the CFATS framework 10 years ago a risk-based
performance standard focused on cybersecurity. Certain we can,
on the training front, always improve, and I appreciate,
really, Jay's feedback on that front. We are always looking to
expand and enhance our training for our really top-notch
inspector cadre. So very much appreciate it.
Senator Peters. Right.
Chairman Johnson. Thank you.
Mr. LeGros. Senator, can I ask a question of the Director?
Chairman Johnson. Yes.
Mr. LeGros. So when you are referring to half the
inspectors being trained, are you referring to partial or
significant levels of cyber?
Mr. Wulf. I think when I am talking about the half I am
talking about the half who have gone through the more advanced
cyber training.
Mr. LeGros. OK. The problem we are having as inspectors, or
the lead inspector, when I go into our database, which is
ChemSec, to schedule an inspection, because we have the three
levels of cyber integration--the minimum, the partial, and the
significant--as the Director said, and I put it in my notes,
there are the four questions that we ask for a minimum. Do they
have cyber policies, do they conduct cyber training, etc.
If I receive a facility that has a partial, when I go in
there and click inspector with cyber training, the list that it
gives me is the exact same list as a general inspector. I am on
that list. I cannot do it. When you do a significant, it
plainly states that it will be assigned by headquarters. And as
I referred to in my statement, they are actually coming out
with a new guidance document that it does talk about minimum,
partial, and significant, and especially significant being done
by a headquarters cyber subject matter expert (SME). But when
you actually look at the other paragraphs under it, it says it
will be determined by the branch chief for compliance, which is
basically what they are doing is they are trying to push all
this stuff onto us. And I understand that they say other
inspectors have had training, but even the ones that I know
have had training, they were not sent by headquarters. They
have done it on their own time. They signed up for these
classes because they have the interest on it. But as far as
headquarters providing the training, they have not.
And I will be honest with you. The way our schedule is,
with so many inspections, because of the stuff that is being
dumped on us, we do not have the time to do this stuff. As I
explained in my statement, there are weeks that go by where I
have inspections on Mondays and Thursdays. So when I have an
inspection on Tuesday, Monday I am preparing for an inspection,
on Wednesday I am preparing for the inspection on Thursday, and
it is a revolving door effect. And with so much being dumped on
us--and I hate to use the word ``dump,'' but dumped on us--it
is hard for the inspectors to complete the inspections in the
time given, and, honestly, to be able to get the training. We
do not have enough inspectors. Apparently we do not have enough
people at headquarters to do what they need to do as far as the
reports go.
Senator Peters. So if I gather from your comments, when it
comes to reviewing the types of cybersecurity protections at a
facility, given the lack of training, given the time
constraints, other things that you have mentioned, basically
inspectors--it is just a box that is being checked. There is
not a deep dive as to whether or not this facility is secure?
Mr. LeGros. Well, the ones that are partial, again, it is,
like I said, there are four questions but two are actually to
the facility. The other two is based on our opinion. And I am
not a cyber one, and it is hard for me to honestly say, are
they able to thwart the ability. I do not know. A lot of times
it is a conversation with the cyber person at the facility who
either has a bachelor's degree, a master's degree in computer
science, or some kind of certificate for cybersecurity, and
that sort of thing. So my opinion is based on their opinion.
Senator Peters. Right. So you are asked to give an opinion
based on--without any training, and you have to rely on what
you are being told by the facility, basically.
Mr. LeGros. Well, the right training.
Senator Peters. Right. OK.
Mr. LeGros. At cyber things change daily, yearly, whatever.
But we have not had the basic in-depth training on
cybersecurity and cyber systems that we need. And, I am sorry,
what was the other part of the question?
Senator Peters. No, that is it. I appreciate that. Thank
you.
Thank you, Mr. Chairman.
Chairman Johnson. I think one thing we really need to be
concerned about is mission creep, and I think CFATS is meant to
address a particular problem. Cyber is incredibly complex and
it is changing all the time. I think it is unrealistic to think
that CFATS inspectors can be cyber trained and really ought to
be doing a deep dive. I think it is just kind of outside the
scope of what CFATS ought to be. That is my own personal
opinion.
So what I would recommend is focusing the efforts on the
task at hand, prioritizing things, and kind of let the cyber
issue be
dealt by other people within DHS. I just do not think you can
address--just because you are going in inspecting these sites,
you should be addressing every possible risk that these
businesses are subjected to. That is my own personal opinion.
Senator Carper.
OPENING STATEMENT OF SENATOR CARPER
Senator Carper. Mr. Chairman, a number of years ago I was
fortunate enough to become Chairman of this Committee, and Tom
Coburn became the Ranking Member of this Committee. There was
an article in, I do not know, Washington Post, one of these
papers, that talked about the new leadership of the Committee,
who was Chair and Ranking Member. They mentioned that I was
going to be the new Chairman of Homeland Security, and the
article went on to describe me as the Senate expert on
cybersecurity. And I took the article and I showed it to my
wife and I said, ``Your husband is now the expert on
cybersecurity in the Senate,'' and she said, ``In the land of
the blind the one-eyed man is king, and you are that one-eyed
man.'' To your point.
What I want to do is just briefly ask, just to go down the
list, and we will just start with Debra, and just give us,
quickly, one thing you think you all agree on. Just one thing
in the conversation here. What is one thing you all agree on?
Ms. Satkowiak. We all agree that protecting the security of
our great nation is of absolute importance, and particularly in
today's environment.
Senator Carper. Thank you. Ms. Menendez.
Ms. Menendez. I think that you will hear that theme across
the board, but I do agree that we are all responsible for the
security.
Senator Carper. OK.
Mr. Louchheim. I will echo that. I will add that Mr. Wulf
and his team do a great job to also forward that mission and
deserve those accolades.
Senator Carper. Mr. Wulf, are you going to sit there and
take that?
Mr. Wulf. I will gladly take that.
Senator Carper. All right. Mr. Erny.
Mr. Erny. I think we can all agree that the approach that
DHS has taken over the history of their program has really made
a big impact, and I think they should continue with this
collaborative approach with the industry. Everybody benefits by
this. We all have the same goal here, right? We want to improve
security of our facilities, our operations, and the communities
where we live.
Senator Carper. Thank. Mr. Mr. Eppli.
Mr. Eppli. I would echo that the security of this country
is critical and CFATS is focused on that. I would also echo a
comment that was just made that DHS has done a great job of
being collaborative in working with us to get to that goal.
Senator Carper. Thank you. Ms. Gibson.
Ms. Gibson. I think we all agree that regulatory certainty
is needed, and in that light I think we all--although one of
our groups has a caveat--would support the multi-year
reauthorization.
Senator Carper. Thank you, ma'am. Mr. LeGros.
Mr. LeGros. I agree that CFATS regulation is a great
regulation. It just has its areas that it needs to be tweaked,
if you will.
Senator Carper. All right. Thank you.
Mr. Currie. I think we all agree that the security of
chemical facilities is critical. Like aviation, this is one of
the things that has actually been used in terrorist attacks in
this country, so it is still a huge concern. But I think we all
agree that the Federal Government needs to continue working
across its departments and its programs to make sure that their
oversight is sufficient.
Senator Carper. Good. Mr. Wulf.
Mr. Wulf. And I would just pile on, I think we all agree
that the chemical security threat is a real one. It is a very
relevant one. I think we agree, as well, that CFATS is well
suited to the task of securing our highest-risk chemical
infrastructure and that its strength, as a program, really lies
in the commitment of the entire community. This is not
something that DHS can do alone without the buy-in of our
industry stakeholders who have been great across the board.
Senator Carper. Thank you all.
I want to go back to something Mr. Erny said. I think he
suggested maybe three ideas, one dealing with transparency,
second, I think, there was the term ``elimination'' was used in
one of your suggestions. I think a third one you used the word
``establish.'' But just go back to your three recommendations,
and very briefly say what they were.
Mr. Erny. Sure. Thank you.
Senator Carper. And what I am going to do is ask anybody
else on the Committee panel to comment, favorably or not.
Mr. Erny. Sure. So the three top changes I think that would
really do a big job in improving CFATS would--one is improve
the transparency with the tiering determinations that are made.
Often times I hear from our members that they are not directly
engaged on what the risk factors are associated with their
tiering. And so, there is no reason that the security manager
of a site should not understand the details of the threat that
he is supposed to be protecting against. This is the guy that
has the responsibility for it. He has the authority, the
resources to be able to put into it.
So I think DHS has done a better job----
Senator Carper. I am going to ask you--go ahead. I do not
want to run out of time.
Mr. Erny. Just real quick----
Senator Carper. Your next two ideas.
Mr. Erny. You got me on a roll, so----
Senator Carper. Yes. Thank you.
Mr. Erny. And then, second, eliminate the requirement for
this tariff screening personal surety item for the lower-risk
tiers. And then, third, is establish a CFATS recognition
program. This would essentially look at the industry
stewardship programs in a way that would offer some regulatory
recognition for those sites that are in full compliance.
Senator Carper. OK. And let me just ask the other members
of the panel, anyone have a concern with any of the three
points that Mr. Erny has made? If so, please share those with
us.
Ms. Satkowiak. Senator, if I may comment, please. I do want
to mention--so I do agree, obviously, with transparency. Our
member companies seem to feel that DHS, they are very friendly,
very professional, and they will have that conversation with
you, and we provide them the data, and then there is some delay
as they go back to headquarters and they make decisions and
then they provide a response, and then we have the opportunity
to make adjustments, and then the process starts over. But we
do not have that because it is not prescriptive. We do not have
that ability to plan ahead. And so we would very much support
some changes that way.
In regards to eliminating TSDB screening, I just want to
remind the Committee that as ATF-regulated facilities, every
single one of our employees and responsible persons must be
screened in order to engage in the explosives business, whether
it is constructive possession or whether it is physical
possession. They must be screened against all prohibited person
factors as ATF has established them. Now, ATF does screen
against TSDB, although it is not considered a prohibitive
factor. They do screen against it and then they will make
referrals if there is a hit against TSDB.
And then I do want to support, if there is any recognition
for CFATS programs. So IME, we developed these safety library
publications that are actually looked at globally, not just
here in the United States but globally, and these are
established by the member company experts, the people that have
expertise in the industry with explosives specifically. And so
our compliance with these has always, as an industry, you
always have the minimum basic regulations that have been
established by ATF and then our best practices that are piled
on top.
Senator Carper. All right.
Ms. Satkowiak. But thank you for the opportunity.
Senator Carper. And finally, Mr. Wulf, and then I think I
need to step aside.
Mr. Wulf. Thank you, Senator. I appreciate it. I will say
with respect to transparency in tiering, it is something that
we have strived to foster. In building the new risk-tiering
methodology, we did this as a community with the participation
of our industry stakeholders. We have published tiering fact
sheets in an effort to inform companies about the types of
factors that inform tiering.
We are certainly available to talk directly to facilities
that have questions about their tiering, and for that matter,
have, and continue to work with facilities as they are thinking
about designing, building new facilities, to run a hypothetical
risk assessment, a hypothetical top screen, to give them some
feedback as to risk decisions they might be able to make to
lower their risk profile and hopefully not find themselves
covered by CFATS. But always eager to talk about ways in which
we can do more. But in developing the new risk-tier
methodology, we are very eager to try to do away with the
historic black box that had been the perception of how our
tiering was working.
With respect to the personnel surety program, the checks
for terrorist ties that are now applied to Tier 1 and 2
facilities, we are open to working on this issue, but the thing
I would note is that across the other 16 critical
infrastructure sectors many of the stakeholders in those
sectors find themselves without the authority to access the
terrorist screening database and to ensure that those who have
access to their critical infrastructure have been vetted for
terrorist ties. And in those sectors they are pretty much
clamoring for that authority.
So, I would worry a little bit about keeping that ability,
that access to the terrorist screening database away from the
vast majority of America's highest risk chemical facilities,
but certainly open to discussing that.
And with regard to a recognition program, across our
community, and, those who are sitting at this table
representing some fine organizations--NACD, ACC, IME--have in
place stewardship programs and they do great work, and they
raise the bar for security, not only at the 10 percent or so of
facilities that find themselves covered under CFATS but at
those other 90 percent. So, very interested in working with the
Committee on prospects for ways in which we can recognize those
programs within CFATS, whether that is the ability to place
facilities that are in good standing with those programs on a
less frequent inspection cycle, or other ways of recognizing.
I think one thing we would want to ensure is that those
programs are more or less in alignment with the 18
comprehensive risk-based performance standards that form the
core of the CFATS program.
Senator Carper. Mr. Chairman, I just wanted to thank you
again. I thanked him privately and Senator McCaskill, for
hosting this roundtable. When Dr. Coburn and I and our staffs
worked
on this 4 or 5 years ago--we actually worked on it for quite a
while--and I was not sure we were going to be able to come to a
consensus and pass legislation that would be signed into law.
But I am proud of the really collegial effort that we are
privileged to take part in.
At the time we realized that this is not the Ten
Commandments. It is not written in stone, and we are going to
learn some things as we go through the last 4 years, and learn
some more things as we go through the next 4 or 5 years. But
you have given us some wonderful feedback and it is
interesting. Senator Johnson and I, a lot of times when we have
these hearings we ask the witnesses, like, ``What can we do to
be helpful'' in whatever issue we are dealing with. Almost
always they say, ``More oversight. More oversight.'' And one of
the nice things about having reauthorization period is it
actually compels the oversight, and I think this has been
actually most helpful. So thank you, one and all. Thank you.
Chairman Johnson. Let me just say, Senator Carper, I think
you and Dr. Coburn ought to be commended. When you did
reauthorize this you improved it. You did not make it more
complex. We actually started to streamline it, which really is
the purpose of a reauthorization. Let us take a look at what we
have learned, utilize that information, and let us make this
even better moving forward. And that is exactly what you did in
2014 and that is the goal here, so appreciate that.
In terms of streamlining, let me go right to the explosive
industries and why did they lose that battle? Why were they not
exempt like some of these other areas in our economy? And I
will go to you, Mr. Wulf.
Mr. Wulf. Yes. So I was not at DHS to fight that battle. In
fact, I was over at ATF at the time, so I am not sure I can
comment on the battle.
I was fighting some other battles.
Chairman Johnson To me it makes perfect sense. It seems
like ATF, from what I have read, has done a really good job at
keeping explosives out of the hands of line actors. Why would
we not just carve them out and say, you are not going to serve
two masters. In this instance we are going to just leave you
under ATF.
Mr. Wulf. ATF, absolutely great organization with a long
history of regulating explosives, explosives commerce, and they
have a focus on a number of aspects of safety, in particular,
security as well. I certainly do not want to get into the
relative strengths of the program. They are different in many
respects. And, I am not sure that CFATS is not an inappropriate
supplement to ATF regulations at the highest-risk facilities.
Chairman Johnson. OK. Tell me what CFATS adds in terms of
the security of this Nation by doubly regulating the
explosives.
Mr. Wulf. Yes. I think we are sympathetic to the
duplicative regulation situation, and, there are by our count,
about 30 or 31 facilities that are regulated under CFATS only
for explosives, that, if I am sort of counting things that I
would not lose much sleep about exiting the program that would
be pretty far up there.
Chairman Johnson. So let me just say, barring a really
strong justification for having both regulatory agencies, I am
going to be strongly supportive of exempting explosive
industries from CFATS. So I would need more information to
actually convince me that is not the right thing to do.
Mr. Wulf. Yes. So I think there are some complexities and
nuances among other things. ATF regulations do not cover IED
precursor chemicals. So, the security and/or safety regulations
that apply to explosives under ATF are not there for
precursors. So I think, while we are certainly open to talking
about the exit of explosives from the program, there is not
similar coverage at ATF for the precursors.
Chairman Johnson. Can you explain what that means?
Ms. Satkowiak. That is a fair statement, actually. So ATF
is very clear that they only have jurisdiction over explosive
materials. And so if there is the materials, before they are
mixed together and become an explosive material, they do not
have jurisdiction there.
Chairman Johnson. So are those precursors also in and of
themselves dangerous?
Ms. Satkowiak. No. Not in and of themselves.
Chairman Johnson. But combined, I mean, they can be made
dangerous very quickly.
Ms. Satkowiak. Correct. I must point out here that there
are materials that are on the retail market that do not fall
under DHS CFATS such as the binary exploding targets that those
are not our members' materials, and they are available via the
Internet, retail store, that are not explosive materials until
they are mixed. Those are precursors.
Chairman Johnson. OK. So again, I am very sympathetic to
what they are making----
Mr. Wulf. And we are sympathetic.
Chairman Johnson. I will ask you both to argue your case,
and give me your best shot. Give the Committee staff your best
shot on that.
Mr. Wulf, why four tiers? As we are talking about here, we
are already basically breaking them into two tiers. You have 1
and 2, you have 3 and 4.
Mr. Wulf. Yes.
Chairman Johnson. So why not just 1 and 4, or 1 and 2?
Mr. Wulf. Yes. That is the way the program was historically
arranged. It is fair to say there is----
Chairman Johnson. Is it time to fix it, maybe?
Mr. Wulf. We are open----
Chairman Johnson. That is why I am asking.
Mr. Wulf. We are open to that. I do not think there is too
much difference in the way Tier 1s are treated versus Tier 2s,
or the way Tier 3s are treated versus Tier 4s.
Chairman Johnson. So again, in reauthorizing, I am trying
to simplify this. Can anybody think of a reason why we have
four tiers? Would it be every bit as safe and would it
streamline things to just have, you have this tier and you
have, number 1, you have number 2, and leave it at that? Is
there any justification for having four, other than we just set
it up that way?
Mr. LeGros. I think some facilities would have an issue
with it, and actually doing it, because the way our RBPS
guidance document, the way it is set up to where, for Tier 1
must have, Tier 2 should have, examples like that.
So as far as a tiering level is one thing, but when it
comes to the implementation of security measures, if that was
not also changed to coincide with those tiering levels----
Chairman Johnson. Again, I am concerned about
overcomplicating these things, and, just because you are just
below this threshold we are not going to make you do this.
Maybe it would be just a lot easier for industry itself to say,
no, I mean, if you are above this--everybody above that
threshold is doing these things, rather than try and slice it
and dice it so many different ways that it just makes it
complex, and it makes it more difficult for industry. Again, I
am asking industry on this thing.
Mr. Eppli. So, Senator, candidly, when we look at new
opportunities, currently we are Tier 3 at both of our
facilities. When we look at new opportunities for customers and
there is a potential that it may pop us into a Tier 2, we will
push back really hard and probably not say yes to that
opportunity, because of the tiering requirements and the
additional work that we will have to do with DHS. We see there
is a break, maybe, in 3 and 4 and 1 and 2.
Chairman Johnson. Anybody else want to chime in on that
one?
Ms. Menendez. Chairman Johnson, I would like to express my
concern over the tiering transparency that we have, and if you
are going to go to a 1 and 2 tier, the tiering transparency
really has to be clear as to where you fit in those tierings.
As an example, we had a facility, the one that I opened up
with on the former naval ammunition depot, that was previously
tiered a 2, requiring us to implement all of these security
measures. When CFATS 2.0 came about we had to re-tier. We
dropped to a Tier 3, with no explanation. We had no change in
the facility, no change in the chemicals, no change in the
quantity of the chemicals, and we dropped down to a Tier 3.
Chairman Johnson. And there was not a criteria that showed
you, even though you did not change, we changed our criteria so
this is why you are a 3?
Ms. Menendez. Correct. And so, of course, my management
wants to know if capital investment was necessary.
Chairman Johnson. Mr. Wulf, how can that be? I mean,
honestly. How can we have these four tiers, and industry does
not even know what the definition is?
Mr. Wulf. So we do, as I mentioned, publish, and somewhere
in my pile of papers I have a tiering fact sheet that outlines
the factors that inform tiering.
Chairman Johnson. How many pages is the tiering fact sheet?
Mr. Wulf. It a single page. Single page. Maybe double-
sided.
Chairman Johnson. Is that not sufficient?
Ms. Menendez. It is not prescriptive.
Chairman Johnson. So this is one example where you actually
want a little bit more information from the Federal Government.
Mr. Wulf. So I would say, as well, and I think I have said
it before, that we are very open to talking directly, and we
talk almost on a daily basis to facilities about their tiers,
and again, to running prospective facilities through
hypothetical tiering. So we appreciate that feedback and our
goal is to provide maximum transparency.
Chairman Johnson. So here is task number two. The first one
is we have to figure out what we do with explosive companies.
The second task, industry and DHS, we need to figure out what
we are going to do with the tiering system, and, how do we
define it and whether we really should have four tiers, three
tiers, or two tiers. What can we do to make that completely
transparent, where the criteria is incredibly obvious, and it
actually matches what the risk is and what the reaction would
be. This should have been done sooner, but let us do it--with
this reauthorization, let us get this thing nailed. OK? I think
that makes perfect sense.
Mr. Wulf. I think that is fair. And, I think important to
note, though, that we have a new and improved risk-tiering
methodology that now accounts more fully for all elements of
risk. So while there has been some change in tiering as we have
rerun everyone through that we are very eager to ensure that
regulated facilities understand why tiers might have been
changing.
Chairman Johnson. OK. Well, I do not think they do, and I
am always concerned, too, the mission creep and the greater
complexity. Again, what I am trying to do in this
reauthorization would be to simplify this, without risking
safety. And, by the way, I think when you simplify things you
are going to make it more safe and secure anyway.
Yes, Ms. Gibson.
Ms. Gibson. I guess the only concern I would have is that
DHS did just go through this whole re-tiering process with the
new methodology, and facilities are settled into that now, and
if we change the tiers we would have to go through that process
yet again.
Chairman Johnson. But did you understand what it was when
you re-tiered them?
Ms. Gibson. From the association perspective, I heard a
couple of comments from our members, but they were able to talk
to people at DHS headquarters and talk through it, so it was
more of an individualized basis where they had questions and
they hooked up with the right people to give them some answers.
Chairman Johnson. Mr. Erny, you are with the chemistry
society. I mean, is that similar as well?
Mr. Erny. Yes.
Chairman Johnson. I do not want to force something----
Mr. Erny. I think you have hit on a good thread here. I
mean, we have an opportunity. There are probably a lot of good
ideas like this, simplifying the tiering levels, reducing the
number of COIs.
Chairman Johnson. But again, if simplifying is to have to
go through the entire process again, it may not be worth the
simplification.
Mr. Erny. Yes.
Chairman Johnson. OK?
Mr. Erny. Yes. There are going to be some rumbling about
going through this process again. There is no doubt. I agree
with Jennifer.
Chairman Johnson. So again, I want to get a better
assessment of exactly where we are in terms of definition, the
criteria, the transparency of it, and if it really does make
sense. Again, I do not want to upset the apple cart. I really
do not. Even if it may be flawed, if it is working well--keep--
if it ain't broke at this point, do not fix it. OK?
Ms. Satkowiak. Mr. Chairman, if I may add one more thing in
terms of simplification. When you asked about the precursor
materials, in the commercial explosives industry we treat
precursor materials just like they are explosives, in terms of
distribution. So if you are not qualified in the same way that
an explosives licensee or permittee is to receive explosive
materials, our industry members do not transfer those precursor
materials to you.
Chairman Johnson. OK. I am just looking at my notes I made
with each witness here. Again, I need to underscore again,
because I am asking tougher questions, how much I appreciate
the fact that DHS really does approach this cooperatively.
Now, that being said, when I talked about the Stockholm
syndrome earlier, one of the things I will ask industry to do
is view yourself potentially as whistleblowers and provide us--
because, again, there is concern. I mean, you would be crazy
not to be a little worried about something you might say that
might rub DHS the wrong way, and potentially retaliation. I see
that all the time in government. I am not accusing--OK. So I do
want a completely open format for you to convey suggestions,
complaints to our staff, not in an open hearing, not for
publication, but really under the protection of whistleblower
protection this Committee affords. OK? That would be the best
way to actually get this done.
So you may not be free to say everything you want to say on
the record here today, but you are completely free to, and I
encourage you to provide that kind of information to the staff.
OK? Again, underscored by the fact that I truly do appreciate,
and I do not doubt for a second that this is one example of
government working
cooperatively with industry--and I think your track record
proves it--working together with that shared goal of keeping
this Nation safe. I mean, this is actually a pretty good story
from that standpoint.
I want to ask, Mr. Erny, so, listen, I love awards for
things, the leg lamp. But other than getting a leg lamp, what
would be the purpose of a CFATS recognition program?
Mr. Erny. So one thing that a lot of us have here in common
are the stewardship programs, right, and we all have a security
component to that, and we are largely doing the same--a lot of
the same things that you see in the CFATS program--the
requirement to do vulnerability assessments, establish site
security plans, implement measures, all that kind of thing.
We think there is a real opportunity here for CFATS to be
able to leverage those programs. So some ideas about what kind
of recognition could you give companies. I mean, you would have
to lay out some criteria. We have some very definitive ideas
about what kinds of criteria should be embedded in CFATS that
outlines sort of this minimum performance for these programs.
And so some of the incentives could be things like risk tiering
credit for companies that are in compliance with these industry
stewardship programs.
Chairman Johnson. So it would not be for a leg lamp. It
would be for----
Mr. Erny. Regulatory recognition.
Chairman Johnson [continuing]. Exemption of certain more
onerous regulatory burdens.
Mr. Erny. Absolutely.
Chairman Johnson. So you would be self-certifying in that
type of thing.
Mr. Erny. Yes.
Chairman Johnson. OK. I kind of figured that but I wanted
you to get that on the record.
Mr. Erny. Yes.
Chairman Johnson. Again, I come from industry where you had
International Organization for Standardization (ISO)
certification, based on that, if you were ISO certified at a
certain level, when medical device manufacturers came in there
were just things you did not have to go through----
Mr. Erny. Correct.
Chairman Johnson [continuing]. In terms of your audit again
because you had done that yourself.
Mr. Erny. There are some good example out there in this
regard. I mean, this is not a unique idea. And I think we just
have not broken into the CFATS realm yet.
Chairman Johnson. Mr. Wulf, do you have any problem with
that?
Mr. Wulf. No. Not----
Chairman Johnson. Do not you think that is a really good
idea?
Mr. Wulf. I do not have a problem with it, conceptually. I
think we actually have the authority now to do that. I
certainly would not have a problem with the recognition in a
statute.
Again, and we have certainly talked about this openly
across CFATS industry stakeholder community, we would want to
work, and I know that our industry stakeholders are committed
to working to ensure that those stewardship programs, if they
were to be recognized under some sort of CFATS recognition
program, would align, in effect, with the 18 risk-based
performance standards of CFATS.
Chairman Johnson. So again, in industry they do that for
their own benefit. Again, the medical device industry. Things
like ship to stock type of certification programs. That saves
their auditors time. But they go and they have surveillance,
those types of things, but it just is a far more efficient and
effective method of doing it. So I think that is something,
staff, we ought to seriously take a look into, if you even have
the authority, something in this reauthorization to spur you on
to actually using that authority to create those types of
things.
Mr. Wulf. Thank you.
Mr. Eppli. Mr. Chairman, as an operator in the industry, we
would be fully supportive of this. It would help us
tremendously reduce the amount of duplicative work that we have
to do, from the governmental side as well as from our own
internal industry standards, which are really stringent.
Chairman Johnson. No. It is bad for business to have
chemicals stolen and used for nefarious purpose.
Mr. Eppli. That is exactly right.
Chairman Johnson. We are kind of nibbling around a cost
benefit. According to my briefing, CFATS costs about $70
million per year to the government. Actually, it surprised me.
In the briefing it said some businesses have spent $100,000 to
comply. I would think some businesses spend a whole lot more
than $100,000 to comply. Does industry have any estimates in
terms of the cost of complying with this so far?
Mr. Eppli. So I can give a little update. This year alone,
to increase our site security cameras and our electronic
security for our buildings, again, two facilities, one that is
66,000 square feet and one that is 44,000 square feet, we spent
between $25,000 and $35,000 on each facility, just this year.
That is just for capital equipment. That is not the training.
That is not our own internal personnel.
Chairman Johnson. And no offense, but you are a small
business.
Mr. Eppli. And we are a small business.
Chairman Johnson. Yes. So I would think the larger
businesses spent far more than $100,000, which is, again--I
think my briefing is just off here. I would think the industry
has spent tens if not hundreds of millions. Ms. Gibson.
Ms. Gibson. That is a tough question because a lot of it
depends on what the facilities already had in place before they
became CFATS regulated. For example, a lot of the companies
that are members of NACD practice Responsible Distribution.
They already implemented security measures, as did others. So I
think it is across the board, depending on what their status
was before CFATS.
Chairman Johnson. OK.
Mr. Erny. Yes. And from ACCs perspective, we do an annual
survey, and it is not CFATS specific. But we estimate that
companies annually spend anywhere from $50,000, depending on
the size and complexity, up to about a half a million dollars a
year.
Chairman Johnson. So I think, to a certain extent, what
your answers are confirming to me is industry is already doing
an awful lot. This may organize the efforts but you are just
kind of utilizing what resources you have already--what
controls you have already put in place, and getting them to
comply with what CFATS is asking you to do.
Along those same lines, what other methods of control are
there? Other agencies--OSHA, EPA, local fire departments,
insurance models. I mean, are we using CFATS and are we trying
to leverage all these different control agencies to accomplish
the same goal?
Ms. Satkowiak. No. I would argue that we are not,
particularly in the explosives arena. DHS specifically does not
recognize the jurisdiction, not only--in our case--ATF, but
DOD, the Pipeline Hazardous Materials Safety Administration
(PHMSA), the Department of Transportation (DOT), and our
members have had to layer on top of already--if you were to
manufacture one type 1 magazine, you are already looking at a
cost of $100,000, and then add on $700,000 for fencing around a
400-acre site.
We have one member company that is DOD regulated, plus ATF
regulated, and they were looking at options that they had to
comply with DHS suggestions, which ranged from between $300,000
to $3 million, because it is in a very remote area, and to have
the type of monitoring system which DHS was suggesting, and
even to include a cell phone tower to send the signals back.
That member company is a small, woman-owned business. They have
20 employees and they are spending $150,000 a year, which he
figured was a bargain to have some security guard come through
at the number of hours that DHS has prescribed. That is really
hard on a 20-employee member company.
Chairman Johnson. Yes. My own experience is government
often is not particularly sympathetic with the cost of
compliance to their regulations.
Does anybody else want to chime in in terms of leveraging,
or lack of leveraging, with some of these other control
agencies?
Mr. Eppli. Yes, Mr. Chairman, if I could. First of all, I
want to reiterate, we have appreciated DHS's position, so I
want to state that, David. But we are regulated by DOT, EPA,
OSHA, the Drug Enforcement Agency (DEA), U.S. Food and Drug
Administration (FDA), and those are the Federal programs, and
there are a number of State programs and then a number of local
programs, including the first responders, which we have a great
relationship with. But we do not see any collaboration amongst
those organizations to help reduce our burden.
Chairman Johnson. Talk about the local responders. I am
assuming you are basically talking about police, but mainly, in
this case, fire department.
Mr. Eppli. Mainly fire.
Chairman Johnson. Again, I have had experience, and Oshkosh
local fire department really does a great job of just educating
everybody, in terms of what they need to do, because if
something were to happen, they need to know where things are.
It was interesting, particularly in rural locations, the
volunteer fire departments, you do not get that type of, I will
call it attention, like we got from very professional, full-
time firefighting force in Oshkosh. But what is your experience
in Columbus?
Mr. Eppli. So in Columbus they do have a volunteer fire
department. That is part of the staff. We have a close
relationship with them. One of the things we realized is we
needed to help them learn about our business, so we actually
collaboratively worked with them, and they worked with us in
scheduling an onsite training session about 2 years ago. They
brought in all types of other agencies and we worked together
so they could understand the chemicals we have onsite. Because,
candidly, one of the things we want to do is manage any
hazardous issues we have internally. So we have our own hazmat
team, probably better trained than the local fire departments.
Chairman Johnson. So let me ask the two industry
association reps, in terms of your experience with the
cooperation between these different control agencies, but even
local fire departments. It does not sound like it is as
professionally prevalent as I experienced in Oshkosh.
Ms. Gibson. Yes. It depends on the area, because some are
volunteer, as Randy said. One of our Responsible Distribution
codes is coordinating with local responders, so all of our
members are required to do that to the extent they can under
our program.
But yes, really, it depends on the area. Some, areas are
very active groups and responders, but it is just a resource
issue on their end, in some cases. But it is a top priority for
our members.
Chairman Johnson. Mr. Erny.
Mr. Erny. Yes. I mean, I would largely echo what Jennifer
just said, with the only exception many of the large chemical
complexes are self-responding. They have their own fire
brigades right onsite. They interact with some of the locals,
but most of them are self-sufficient in this regard, or like
down around the Gulf Coast region, where there is a high
density of chemical processing, oil and gas, they are involved
in these co-op initiatives down there.
So we are probably a little bit different in this regard.
We do not have a lot of the small operators out in remote
America that are dealing with volunteer fire companies.
Chairman Johnson. OK.
Ms. Menendez. May I comment as well?
Chairman Johnson. Sure.
Ms. Menendez. With regard to working with the local
responders, I do agree. It really depends on the site. Every
site is--whether it is in a large community, some of our
employees, because it is such a small community, they are
members, or their families are members of the local responders,
so they are aware of what we do because of their family
members. We reach out to them every year. We are required to
report, under the Right to Know Act, the chemicals that we have
in place, and we invite our members of the local fire
departments to come out and learn what we do, see what we have
onsite, understand how to respond properly. But it is difficult
when you are dealing with a voluntary fire department.
Chairman Johnson. So my last question, and then I will go
down the table here and ask you for anything that you just have
to get off your chest. But, the big chemical guys, they are
going to have all the security, all these programs in place. It
is really the smaller folks that are going to be more
vulnerable, and do not have the resources to do that. To me,
probably the best defense against that is a really good
reporting system, because even small guys, hopefully, will
notice if something is missing, and they will be concerned
about inventory shrinkage, or whatever.
As part of this, do we have a really good reporting system
when that happens, kind of a no-fault, with no penalties, but
literally a small operator out in a rural area going ``I am a
little concerned because we are just missing three pallets of
this dangerous chemical.'' Is that a very streamlined reporting
system up to DHS?
Ms. Menendez. Interesting enough, we account for every
movement of our explosive materials. We double-count four in
four different instances. So eight times a day we are counting,
when we acquire the material, when we put it on our trucks,
when we send it out to the customer sites, when we arrive at
the customer site, when we use it, when we put it back in the
trucks, and then put it back into our magazines. It is counted
by two people every step along the way.
So we feel that when we do incur a theft or a loss of
explosives, while ATF requires us to report within 24 hours, we
report by the end of the day. And we may have to amend if we
discover where that product was, but we report immediately to
ATF, we report immediately to our law enforcement, and we fill
out a form and send that in to the bomb center.
Chairman Johnson. OK. But again, you are an exception in
this category, a good exception. What about in just basic
chemistry?
Mr. Louchheim. Well, I will take a stab first here, sort of
with a lot of smaller facilities around the country in rural
America. Like I said earlier, we probably estimate around 6 to
6,500 agricultural retail facilities around the country. About
1,500 facilities, or 1,400 of those, approximately, are CFATS-
regulated facilities.
I would kind of circle back on our ResponsibleAg program,
actually. This is, I think--which, along with recognition
programs I think has a place to be part of a CFATS
reauthorization in some fashion. For ResponsibleAg, for our
industry, it is a third-party-audited system with auditors that
go through these facilities. Like I said before these
facilities typically only have 5 to 10 employees at them. So I
think in your comments previously you mentioned, there is not
always the same sophistication in those settings as there would
be at a major billion-dollar production facility.
So ResponsibleAg. That is working with these facilities to
comply with OSHA, DOT, EPA, DHS regulations, to make these
facilities safer, help them work to be safer and comply with
basically a myriad of Federal regulations that are out there.
Yes, the agencies could sometimes work together a little
better to streamline things, but we are going to work to make
sure our industry is as safe as possible through ResponsibleAg,
and other initiatives. Theft and diversion, knowing your
customer is essential. We preach that to our members, and our
members already know it.
Chairman Johnson. But again, the main point of CFATS is if
these chemicals are stolen, to be used by maligned actors.
Right? So again, I am just asking, as part of this, do we have
a really good, well-communicated and well-executed reporting
structure, even to the small guys, because, quite honestly,
they are the ones that are going to be more vulnerable. If I
wanted to steal chemicals, I would go to a little guy that does
not have the million-dollar security system.
Mr. Wulf. Mr. Chairman, I think that is where CFATS makes a
big difference. So, for high-risk chemical facilities, one of
the risk-based performance standards is RBPS-9, focused on
response. And under that standard, facilities connect with
their local responders, establish those reporting chains. In
many cases we will help them to facilitate that contact, and I
think that goes a long way.
Chairman Johnson. But in order to have to comply with RBPS-
9 do they have to be a Tier 1 or 2?
Mr. Wulf. No. That applies across the board. And I would
mention, also, that, our detection and monitoring standards are
aimed at ensuring that facilities have in place measures that
enable them to detect thefts or diversions in near-real time,
so as to promote an effective law enforcement response. We are
certainly sensitive to the costs that those sorts of measures
can bring to a facility, but we pride ourselves on compliance
assistance. So our inspectors are not out there just doing
compliance inspections. They are available, our headquarters
staff is available to work with facilities, to talk through
what, in many cases, can be lower-cost options to meet the
spirit of the risk-based performance standards.
Chairman Johnson. OK. Why do not we close this thing out,
and we will start with Ms. Satkowiak.
Ms. Satkowiak. Thank you again, Mr. Chairman, for this
opportunity. IME has been asking for years. We have been
seeking for regulatory relief to remove explosives from the
chemicals of interest, Appendix A, and getting, again, relief
from that duplicative regulation. We have been asking for data
to show justification as to why explosives materials were
included under the program.
Certainly, again, the government data that is out there
shows that in the bombings that have happened here in the
United States, only between 1 and 2 percent of those have
involved commercial explosives materials, and the number of
thefts are so low, they have plummeted since 1985. In the years
leading up to CFATS, they have plummeted more than 80 percent,
and it was industry and ATF regulations that brought that down.
So CFATS program did not have any demonstrated improvement in
that security, despite the millions of dollars that our member
companies have incurred.
So I just also want to reinforce, as you are considering
the removal of explosives materials through a statutory
exemption, which is what we are looking for, is that by ATF
requirements, which I sometimes get the feeling are being
discounted by DHS, we have accountability for every single
trace amount of explosives materials. There is no threshold. It
is any amount of explosives materials, they are accounted for.
I have heard the term ``track and trace.'' It is not exactly
what it is called under ATF. We have accountability for every
single movement. So we know if any piece has been missing,
diverted, or has fallen into the wrong hands. Every single of
our employees and responsible persons, again, are vetted.
So for these reasons we feel that these duplicative
regulations can be removed off of the explosives industry, and
thank you again. Appreciate your time.
Chairman Johnson. Ms. Menendez.
Ms. Menendez. Thank you. Each business has its own
regulatory environment applicable and beneficial to its
operations. It is with confidence that Austin Powder relies on
the Federal explosives laws and regulations and 27 CFR 555,
Commerce and Explosives, to remain compliant as we build our
business.
We respect those that appreciate the CFATS oversight in
otherwise unregulated or minimally regulated businesses, but my
testimony today was meant to provide evidence that in a highly
regulated industry like the commercial explosives industry,
layering additional DHS regulation on top of existing ATF
regulation has proven to keep commercial explosives secure, is
unnecessary and very confusing.
Chairman Johnson. OK. I understand. Mr. Louchheim.
Mr. Louchheim. Sure. Thank you, Mr. Chairman, for holding
the roundtable today. I appreciate your kicking off the process
and getting things moving. Like I said earlier, we support a
multi-year reauthorization of the CFATS program. Four to 6
years seems to make sense.
In general, the program provides a good framework for
security measures for a number of our members' facilities, and
we think that is helpful and valuable. We think transparency is
important to look at as we do reauthorization. We think that
the Personal Surety Program, as has been mentioned, should be
limited right now to Tiers 1 and 2. And we think stewardship
programs have a valuable place in the program, to bolster our
Nation's security.
Chairman Johnson. Again, you do not have to restate what
you have already stated, but this is for new information. Mr.
Erny.
Mr. Erny. Yes. They stole all my thunder. I think I
probably would have said exactly the same thing. Appreciate the
opportunity. I look forward to working with your staff to find
more ideas about how we can streamline and make this program
better. Thank you.
Chairman Johnson. Mr. Eppli.
Mr. Eppli. Thank you for the opportunity to be here. We do
want a safe country. For business, we need certainty, so we
would like some certainty. I think that ties to how long this
should be reauthorized. We believe it should be reauthorized. I
would stick with at least a minimum of 4 years. DHS has been
good to work with.
I would like to get some recognition of some of the other
duplicate work that we do, with either agencies or with the
recognition of the stewardship programs that we have in place
through Responsible Distribution, with NACD, or Responsible
Care at ACC.
Chairman Johnson. OK. Ms. Gibson.
Ms. Gibson. Yes. Thank you, Mr. Chairman, for holding this
roundtable today. I would echo what my colleagues here have
said and just want to reiterate that even though chemical
distribution is very highly regulated by many agencies and we
have a 28-page regulatory resource guide and checklist for our
members; we do still strongly support the CFATS program and
DHS's approaches to implementing it. We think that should be a
role model for other agencies, and we look forward to working
with you and the Committee on reauthorization.
Chairman Johnson. Mr. LeGros.
Mr. LeGros. Thank you, Chairman, for having me here today.
I would just like to reiterate the reauthorization of the CFATS
program, and again, the reason why I am here is as far as the
cyber and the training issues that need to be addressed by the
agency.
Chairman Johnson. Mr. Currie.
Mr. Currie. Two quick adds to the discussion. One, I think
we have been looking, at GAO, at this holistically across the
country, and I think measuring risk reduction or the security
benefit is really difficult. It is hard to do that with just
outputs. So I think we need to continue to push DHS to try to
measure across the country how we are reducing risk.
The second piece is we have done a lot of work on
overlapping Federal regulatory programs in a lot of areas, and
the Federal fatigue that can set in when that happens. And I
think there is a lot that can be done at the agency level, and
with the States, to coordinate behind the scenes, to actually
make a big impact on a lot of that.
Chairman Johnson. Mr. Wulf.
Mr. Wulf. Excellent. Thank you. I thank you so much, Mr.
Chairman. I think this has been a great dialogue. I think we
are in agreement that CFATS does make America more secure, that
long-term authorization affords important stability to the
program, important certainty for our industry stakeholders. I
would note that I am certainly not averse to, even during a
longer term,
10-, 20-, 30-year authorization period----
Chairman Johnson. That will never happen. I am just telling
you, it would never happen. I am sorry.
Mr. Wulf. But I will say changes can be made.
Chairman Johnson. Unfortunately, we have so many things to
look into. The only reason we are looking at this today is
because we have to reauthorize it.
Mr. Wulf. Yes. I appreciate that. And I also appreciate the
active engagement of our industry stakeholder community. I
think, as you have seen today, they are not a shy group, not
shy about telling us how they think the program can improve.
And, this is a shared enterprise, and I think it is a program
that is well tailored to the task at hand. It is narrowly
targeted to America's highest-risk chemical facilities, and
really do appreciate your leadership on reauthorization.
Chairman Johnson. OK. Again, thank you for your service in
leading an effort that really is recognized as being one that
is cooperative.
Just to reiterate, we would not be having this roundtable
if it were not for the reauthorization. Permanency is, from my
standpoint, off the table. It is really what is the proper
length of time.
Again, we have an opportunity here, and you have a Chairman
who comes from industry, who looks with a great deal of
skepticism, of government control over anything. But the goal
that you laid out there, we all want a safe, secure America.
And we face threats. It is a very unpleasant reality but it is
one that we have to face.
So I am encouraged by the cooperation. I am encouraged by
the fact the last reauthorization honed this program a little
bit better. I think there is definitely room for improvement. I
come from a manufacturing background, continuous improvement.
So I am really encouraging everybody at this table, I think the
roundtable itself was very cooperative. But also recognize I
have the folks here that could potentially be suffering from
Stockholm syndrome.
I want you to be completely honest with whistleblower
protections contacting our Committee. For the same thing, the
GAO, as well as the Department. Let us be as honest and
forthright as possible. Let us produce a better reauthorization
than what is in law today. And again, let us not fix what is
not broken. Let us not upset the apple cart just because it
might be a little bit better. I think we have to really take a
look at the cost of changing something versus the benefit of
making it a little bit better. OK?
So again, this is a really good opportunity. We have the
time. This looks like a very cooperative group. I just really
encourage you to work very closely with staff, be completely
honest, and let us end up with a reauthorization that just
makes this a lot better program. OK?
With that, the roundtable record will remain open for 15
days, until June 27th, at 5 p.m., for the submission of
statements and questions for the record, although you can
always contact our staff. OK?
With that, the roundtable is adjourned.
[Whereupon, at 12:24 p.m., the Committee was adjourned.]
A P P E N D I X
----------
[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
[all]