We frequently hear how things changed after 9/11 and nowhere did they change more than in the security industry. One of the important lessons we learned from the 19 terrorists who attacked us that morning was that we no longer had to just worry about bombs being brought onto our shores. Instead, the nation saw how a common airliner could be turned into a massive, deadly explosive. It taught us what we already had an inkling of, when in April 1995, homegrown terrorists blew up the Oklahoma City federal building with a nitrogen-based (from fertilizer) blast. We learned that terrorists do not need to bring bombs into our country; we already have potentially lethal explosives sitting in airports, chemical plants and manufacturing facilities throughout the nation.
Fortunately, Congress and the Department of Homeland Security (DHS) recognized the need to identify potentially dangerous chemicals and place standards on facilities where they are made, used and stored. Just as the U.S. Environmental Protection Agency (EPA) has required all water districts serving more than 3,300 people to implement increased security measures, so has Congress put in place legislation that directs chemical facilities to undergo a series of risk assessments aimed at identifying potential terrorist targets.
According to DHS, the Chemical Facility Anti-Terrorism Standard (CFATS) was created in 2006 to establish security standards for facilities considered to be at high risk. CFATS defines security requirements based on a list of about 323 chemicals, called COIs or chemicals of interest. CFATS does not just affect the chemical or petrochemical industries. It also includes sectors such as chemical manufacturing, storage and distribution, energy and utilities, agriculture and food, paints and coatings, explosives, mining, electronics, plastics and healthcare.
CFATS does not apply to facilities under the jurisdiction of the Maritime Transportation Security Act (MTSA); Department of Defense owned or operated facilities or those regulated by the Nuclear Regulatory Commission. Public water systems and wastewater treatment facilities fall under EPA regulations.
The DHS set thresholds for each of the COIs. The facilities that use or store chemicals above those thresholds were required to submit a “top screen” to the department. So far, DHS has indicated that about 32,000 facilities submitted top screens. Of those, about 7,000 were notified that they were required to move to the second step – a Security Vulnerability Assessment (SVA).
Facilities were placed into categories after the top screen analyzed the type, quantity, storage, manufacturing and handling of each COI. The SVA then took a more in-depth look at each facility and its existing security and vulnerabilities to come up with a final ranking based on four tiers. Facilities with the highest level of COIs and vulnerability combined were placed into tier one. Those with the lowest levels of chemicals and threats were put in tier four.
According to DHS, the more than 6,000 facilities were divided as follows:
Tier 1 – 140
Tier 2 – 681
Tier 3 – 1,613
Tier 4 – 3,943
DHS considers its criteria for tier rankings to be classified and does not disclose what elements make a facility a tier one. The rankings appear to be based on a combination of factors from the top screen and SVA submissions. Characteristics obviously change from site to site, but tier ratings appear to be based on a combination of COI type and amount, proximity to a population center and the recognition of the COI by the general public.
Letters to tier one facilities were sent out on May 15, 2009 notifying them of their final ranking and the requirement to submit a Site-Security Plan (SSP) in the next 120 days. Letters to the next three tiers are expected to be mailed soon.