The long road ahead for CFATS
CFATS, the Chemical Facility Anti-Terrorism Standards efforts, seems to have received an extension of its life this week. There are actions on Capitol Hill to refund the CFATS program for at least 5 more years and possibly longer, with up to $90 million per year appropriated. Where does that money go? This article (posted on SIW but originally from Congressional Quarterly Today) explains the program succinctly – the money goes to inspectors who process the security assessments for these facilities:
"The law requires vulnerability assessments of site security plans for chemical facilities but prohibits the Homeland Security secretary from disapproving a plan based on the presence or absence of a particular security measure. Instead, the law allows the secretary to disapprove a site security plan if it fails to meet risk-based performance standards."
The key to understanding CFATS is to know that there is not a checklist of security measures that has to be undertaken to meet approval. That's a measure, it seems, to make sure that security is appropriate to each facility rather than being a non-descript list that could fail to take into account the particular security risks each facility faces. The challenge from this type of approach is that it's often a guessing game for the chemical facility operators, explains R.J. Hope, CPP, ABCP.
Hope, a senior physical security analyst for engineering firm Burns & McDonnell, says that it puts plant operators in a step-by-step process. In an interview at the PSA-TEC security expo last week in Colorado, Hope said that it's not uncommon for a chemical facility to upgrade their security based on their risk assessment and then to receive feedback from CFATS inspectors that they need more barriers to entry. Those barriers to entry would not be specified (again, this goes back to the point that CFATS isn't a checklist of cameras, bollards, security fencing, electronic access, etc.), so the chemical facility then has to make its own best guess at what more barriers to entry might be needed, implement those within a specific time frame and then go back to DHS for another review. They might again be told that they need additional security measures (again, no specific requirements – the inspectors aren't going to say "put more cameras at your vehicle checkpoints"), and thus starts the next step of upgrades and the following review. Hope says this process can reoccur multiple times before a facility finally meets the hidden goals that the inspectors have in mind.
The upside is that it keeps security from being as simple-minded as ordering the #5 off the lunch special menu, but the downside is that it can take quite a bit of time before a facility meets the standards. During this process, the chemical company is seeking to minimize security expenditures, so the facility operator is likely to invest in one more round of security at a time, rather than blowing out the budget with millions and millions spent on every possible solution at once (technology, guards, etc.). Because of the number of chemical facilities in the U.S., it paints a picture of a long road ahead to ensure that our nation's chemical facilities are secure. To understand the timeline, it's best to point out that CFATS is really only touching upon the top-tiered/top-risk facilities at this point. Some experts estimate that there are thousands of facilities not currently being addressed, and there have even been moves to add agricultural operations and municipal water treatment facilities to the overall number of facilities since these facilities are often heavy users of controlled chemicals.