DHS Chemical Security Regulations: Potential Issues in a Wide Range of Industries
By Melissa Bailey
The security of chemical facilities has been a concern since Sept. 11. Indeed, the detonation of a truck containing chlorine that recently killed 20 people in Iraq provides a chilling example of how hazardous chemicals can be used by terrorists.
In light of these circumstances, Congress’ directive to the Department of Homeland Security (DHS) to promulgate chemical security regulations was expected. DHS issued interim final “Chemical Facility Anti-Terrorism Standards” on April 9. Congress mandated the regulations in Section 550 of the Department of Homeland Security Act of 2007, which appropriated DHS’s funding for fiscal year 2007. DHS should be lauded for delivering a thoughtful set of regulations on a complex set of issues under the strict time constraints imposed by Congress.
At the same time, the regulations are broad, and will impose an entirely new set of requirements on chemical manufacturing facilities and refineries, many of which are under significant global competitive pressure. The regulations also potentially will apply to facilities that typically are not associated with security issues, such as food service, agricultural and pharmaceutical companies, as well as laboratories and many other types of manufacturing facilities.
The regulations are performance standards designed to permit facilities flexibility in compliance. Although criticism of “one-size-fits-all” specification regulations has been the norm – even during the Clinton administration – performance standards give agencies tremendous power in enforcement actions to interpret broadly worded, ambiguous regulations to require facilities to implement specific measures dictated by the agency. This particularly is true where the agency has issued guidance documents supporting a particular interpretation of a regulation, which DHS says it plans to do.
The regulations also strongly encourage facilities to consider and use “inherently safer technology” (IST) measures, such as substituting less-hazardous chemicals, reducing inventories or changing processing conditions, in their security plans. Industry successfully fought to exclude mandatory consideration of IST measures in Congress, but the methodology mandated by the DHS regulations implicitly requires the implementation IST measures rather than the hardening the exterior of facilities.
Finally, the regulations address the preemption of state and local chemical security provisions, and leave some uncertainty as to whether future state provisions, such as those being considered by New Jersey, will be preempted.
The Basic Regulatory Framework
The regulations set out a multi-step process through which facilities submit information and security plans for approval. These steps are:
Step 1: Each facility that has a “standard threshold quantity” (STQ) of a substance listed in Appendix A must execute and submit a top-screen survey electronically using the chemical security assessment tool (CSAT), the system DHS will use to collect and assess information. Facilities must submit the Top-Screen survey within 60 days of the final publication of the regulation, which will likely be in August 2007 (6 C.F.R. § § 27.200, 27.210).
Step 2: Based on the information from the survey, DHS may make an initial determination that a facility should be placed in one of four risk tiers – with Tier 1 posing the highest risk – and will notify the facility of its risk tier. In the alternative, DHS may determine based on the survey that a particular facility is not “high risk” and is not subject to the regulations (6 C.F.R. § 27.205).
Step 3: The facility submits a security vulnerability assessment (SVA) that characterizes assets, evaluates threats and risks and includes strategies for reducing the possibility and consequences of an attack. The SVA is completed using the risk analysis and management for critical asset protection system, or RAMCAP, and submitted through the CSAT system (6 C.F.R. § 27.215). SVAs must be submitted within 90 days of written notice from DHS or within the timeframe set out in a Federal Register notice (6 C.F.R. § 210).
Step 4: Based on the top screen survey results and the SVA, DHS either confirms or alters its initial determination of the appropriate risk tier for the facility and notifies the facility (6 C.F.R. § 27.220).
Step 5: The facility develops and implements a site security plan (SSP) that meets the risk-based performance standards for the facility’s risk tier (6 C.F.R. § 27.225). The regulations include a list of risk-based performance standards, such as restricting the perimeter of the facility, deterring attacks and preventing theft and sabotage (6 C.F.R. § 27.230). DHS plans to issue guidance on the application of the performance standards to the different risk tiers, and notes that the “acceptable layering of measures used to meet these standards will vary by risk-based tier.” Id. SSPs must be submitted through the CSAT system within 120 days of written notice from DHS or within the timeframe set out in a Federal Register notice (6 C.F.R. § 27.210).
Step 6: DHS reviews and either approves or disapproves the SVA (6 C.F.R. § § 27.240, 27.245). The SSP approval process involves two steps. First, DHS reviews the SSP and either issues a Letter of Authorization approving the plan or disapproves the plan. Second, once the written SSP is approved, DHS conducts a physical inspection of the facility for purposes of determining compliance with the regulations (6 C.F.R. § § 27.245, 27.250).
Step 7: DHS may issue an order requiring a facility to comply with the regulations. If the facility violates an order, DHS may issue an order assessing civil penalty imposing penalties of up to $25,000 per day, or an order to cease operations, which would require the facility to close. A facility may appeal any order or the disapproval of an SSP. Appeals are heard by a “neutral” attorney at DHS who has not been involved in the investigation of the facility. The decision may then be appealed to the Under Secretary of DHS, and ultimately to a federal court.
The Scope: Gas Grills, Refrigerators and College Chemistry Laboratories?
DHS drew from EPA’s risk management programs regulation, the Chemical Weapons Convention – an international treaty to which the United States is a party – and the list of hazardous materials regulated by the Department of Transportation in developing Appendix A. While the list includes substantial quantities of substances that clearly are hazardous, it also contains some substances that will pull industries beyond refining and chemical manufacturing into the regulatory scheme.
Propane: The Appendix A STQ for propane is 7,500 pounds. Propane bottling facilities, propane fueling stations and a variety of other facilities will be required to execute top screen surveys, and may ultimately be covered by the regulations.
Ammonia: The STQ for anhydrous ammonia is 7,500 pounds. Since chlorofluorocarbons were banned because they damage the ozone layer, ammonia refrigeration has become the most common refrigerant. Many different types of facilities, including food and beverage, pharmaceutical and other facilities that use refrigeration, will be required to execute a top screen surevey. While ammonia may form vapor clouds when released, it would be extremely difficult to release all of the ammonia in a refrigerator simultaneously because it is contained in a piping system.
Laboratories and By-Products: Appendix A lists 343 substances, and 106 of these have a threshold quantity of “any amount.” As a result, many laboratories undoubtedly will be required to execute a top screen survey. In addition, some of the “any amount” substances, such as hydrogen sulfide, are common by-products of the manufacturing process that likely are present in small quantities at many industrial facilities.
Risk-Based Performance Standards
Congress explicitly required DHS to issue “performance standards,” and also prohibited DHS from disapproving “a site security plan…based on the presence or absence of a particular security measure.” DHS is, however, permitted to “disapprove a site security plan if the plan fails to satisfy the risk-based performance standards.” DHS exacerbated the difficulties with this somewhat confusing enforcement scheme by stating that guidance would be issued to clarify the “acceptable layering measures” facilities in particular risk tiers must take to meet the risk-based performance standards (6 C.F.R. § 27.230).
The results of this type of system should be all too evident to facilities that are covered by OSHA’s Process Safety Management (PSM) standard, 29 C.F.R. § 1910.119, which also is a performance standard intended to give employers flexibility in compliance. To cite just one example, the PSM standard requires a covered facility to develop and implement “clear” operating procedures. In an enforcement action, particularly following an accident, OSHA routinely asserts that operating procedures were not “clear” because if they had been, the accident would not have occurred. OSHA also often issues guidance documents interpreting performance standards, and this guidance often becomes the de facto regulation because employers must follow the guidance or face enforcement litigation.
The same result is likely with DHS’s regulations. For example, the performance standards require the facility to restrict the perimeter and secure site assets (6 C.F.R. § 27.225). A facility reasonably might choose to focus its resources on securing the perimeter by installing guard stations, Jersey walls and motion sensors, which would lessen the need to secure site assets like chemical tanks that are inside the fence line.
DHS may take the position that under the performance standards, additional process safety protections, such as monitored alarms or sensors that indicate a release, are required for process vessels, tanks or piping. Courts must defer to an agency’s reasonable interpretation of its own standards, particularly when the agency’s interpretation is set out in a guidance document (See e.g. Martin v. OSHRC (CF&I Steel), 499 U.S. 144 (1991)). As a result, facilities may face an uphill battle in enforcement litigation.
Inherently Safer Technology
The inclusion of inherently safer technology (IST) provisions in chemical security legislation was one of the most hotly debated issues in Congress. As stated, IST involves using technologies and chemicals with intrinsic properties that reduce or eliminate hazards, such as substituting less hazardous chemicals, reducing chemical inventories or changing process conditions.
Industry representatives objected to legislation mandating the consideration or inclusion of IST concepts in developing chemical security plans because they did not want government agencies second-guessing process safety and engineering decisions. In addition, the implementation of a particular IST measure almost always results in a safety trade-off somewhere else in the process. For example, using 1-ton cylinders of chlorine rather than maintaining a 90-ton railcar to reduce inventory on site arguably may make the site safer, but it also results in much more chlorine on public highways, which increases the opportunities for a terrorist act such as a hijacked truck. It also increases the chances of a leak because employees are required to make connections to a 1-ton cylinder more often.
The regulations implicitly encourage companies to implement IST measures because the RAMCAP system must be used. In contrast to programs such as the American Chemistry Council’s Security Code, the RAMCAP system is similar to the type of process hazard analysis required by the PSM standard in that it assesses the risks posed by processes rather than focusing on securing the perimeter of a facility so as to prevent entry by a terrorist.
As a result, the RAMCAP system may result in companies implementing IST measures rather than focusing on fence-line security. For example, two large tanks of ammonia likely will raise the risk tier of a facility under RAMCAP. Under the ACC Security Code, the facility may choose to add security features to prevent terrorists from entering the facility and accessing the tanks. Under RAMCAP, the facility will be strongly encouraged to lower its risk tier by dispersing its ammonia inventory throughout the facility into smaller tanks.
DHS officials have acknowledged that covered facilities may be forced to implement IST measures. “We have the ability to make life so burdensome and so uncomfortable on these facilities that they may on their own choose to adjust their business model and the types of chemicals they use,” said DHS spokesman Russ Knocke.
Will the New Jersey System Continue?
In the proposal DHS issued in December 2006, the agency stated that any state or local provisions that frustrate the “carefully balanced regulatory relationship” that “preserve[s] chemical facilities’ flexibility to choose security measures to reach the appropriate security outcome” would be preempted. DHS’s statement on preemption was surprising because Congress expressly declined to include any preemption provision in the DHS appropriations legislation.
DHS used less-emphatic language in the final regulations. DHS stated that the regulations were not “intended to be the equivalent of ‘field preemption’ for facilities determined to be high risk,” and that it had “no reason to conclude that any non-federal [chemical security] measure is being applied in a way that would impede the performance standards or other provisions of Section 550 and this Interim Final Rule.” The regulations allow a facility, state or locality to submit a provision for review and receive an opinion from DHS regarding whether the provision is preempted (6 C.F.R. § 27.405).
The preemption provision may have the most significant effect on New Jersey, which has the most-restrictive chemical security provisions in the country.
In November 2005, the New Jersey Domestic Security Preparedness Task Force adopted regulations requiring chemical facilities to work with employees and collective bargaining representatives to develop prevention, preparedness and response plans that review the practicability and the potential for adopting inherently safer technology measures. On April 16, the state’s Department of Environmental Protection issued a proposal to expand the requirements relating to inherently safer technologies.
Governor John Corzine’s office estimates that the proposed rule would apply to 94 facilities, including “petroleum refineries, water suppliers, major food distributors, wastewater treatment plants [and] pesticide and agricultural manufacturers.”
In light of these provisions, New Jersey officials, including Senator Frank Lautenberg, D-N.J., a proponent of requiring all facilities to implement IST measures, were alarmed by DHS’s initial statements about preemption and filed comments to that effect. In response to Congressional inquiries, DHS Secretary Michael Chertoff wrote a letter to Rep. Peter King, R-N.Y., and Sen. Susan Collins, R-Maine, acknowledging that “[r]egulatory programs such as New Jersey’s require certain chemical sites to perform their own vulnerability assessments and perform their own site security plans, which is similar to the regulatory scheme in the advance notice.” As such, New Jersey’s current regulations apparently are not preempted, but future regulations may be, particularly if they mandate implementation of specific IST measures.
Security at facilities that use hazardous chemicals is a significant concern, particularly in states like New Jersey, California and Texas that may have such facilities in highly-populated areas.
DHS’s regulations may marginally improve security at those types of sites. At the same time, the regulations are not as performance-based as they might appear at first blush. The implicit inclusion of IST measures through the RAMCAP system also may compromise safety outside of regulated facilities if, for example, chemical inventories are reduced such that more transportation is required. Finally, the scope of preemption for state and local provisions remains uncertain, and companies with multiple facilities may be required to comply with a patchwork of federal, local and state provisions.
(The proposed rule is available at http://www.nj.gov/dep/rules/proposals/20070416a.pdf. Comments on the proposal are due June 17.)
Melissa Bailey is of counsel at Ogletree Deakins and has an extensive background in government relations and labor and employment law, including substantial litigation experience in occupational safety and health matters. Melissa provides counseling and litigates occupational safety and health cases before federal agencies and courts, represents clients in government inspections and investigations, and performs audits and compliance counseling. Melissa represents employers in a wide range of industries, including chemical, manufacturing, mining, construction, automotive, health and hospitality services. She can be reached at [email protected]