July 11, 2011
Kim Nelson
DHS Desk Officer
Office of Information and Regulatory Affairs
Office of Management and Budget, New Executive Office Building, Room 10236
725 17th Street, NW.
Washington, DC 20503
Re: DHS NPPD; Chemical Facility Anti-Terrorism Standards Personnel
Surety Program -- ICR Reference No. 201105-1670-002
Dear Ms. Nelson:
The undersigned organizations represent a broad spectrum of the chemical and
petrochemical industries. We thank you for meeting with representatives of several of
our organizations on June 2 regarding this important DHS collection proposal. Now that
DHS has officially submitted the collection to OIRA,1 we are writing to describe our very
serious concerns with it. We urge OIRA to disapprove this collection for four reasons:
(1) the proposed PSP is unnecessary for the proper performance of DHS’s functions; (2)
the proposed PSP is unnecessarily duplicative; (3) DHS has not complied with the
procedural requirements of the Paperwork Reduction Act (PRA) and OMB’s PRA
regulations; and (4) DHS has failed to include within the ICR key facts without which it
is impossible to assess the burden of DHS’s proposed collection.2
By way of background, the proposed collection would implement the “Personnel Surety
Program” (PSP) that DHS has developed under its “Chemical Facility Anti-Terrorism
Standards” (CFATS) regulations, issued in relevant part in 2007.3 The CFATS rules
establish various risk-based performance standards (RBPS) that regulated chemical
facilities are required to meet, which include RBPS #12: “Perform[ing] appropriate
background checks on and ensure appropriate credentials for facility personnel, and as
appropriate, for unescorted visitors with access to restricted areas or critical assets,
including . . . [m]easures designed to identify people with terrorist ties.”4 The PSP is
DHS’s proposed mechanism by which facilities must meet the RBPS #12 standard. The
PSP would require facilities to submit to DHS personally-identifying information regarding individuals seeking access to restricted areas and critical assets at the facility.
DHS would then arrange for these individuals to be checked against the FBI’s classified
Terrorist Screening Database (TSDB).5
Our associations, and their member companies, have collaborated closely and
cooperatively with DHS to stand up the CFATS program quickly and effectively. We
have also actively supported legislation to reauthorize that program for years to come.
We will continue to work with DHS toward our shared goals, including personnel surety.
The currently proposed PSP is improved in some respects from what DHS previously
described. On balance, however, and as explained below, compliance with the proposal
will draw critical facility resources away from the task of implementing other aspects of
the CFATS program and from securing facilities more generally.
I. The Proposed PSP Is Unnecessary for the Proper Performance of DHS’s
Functions
The statutory authority under which DHS has issued the CFATS rules is a rider to an
appropriations statute and is quite general – it provides merely that DHS “shall issue
interim final regulations establishing risk-based performance standards for security of chemical facilities.”6 Importantly, however, it left the choice of security
measures to the facility, so long as they satisfied the relevant standard: [S]uch regulations shall permit each such facility, in developing and
implementing site security plans, to select layered security measures that, in
combination, appropriately address the vulnerability assessment and the risk-
based performance standards for security for the facility[; and] the Secretary may
not disapprove a site security plan submitted under this section based on the
presence or absence of a particular security measure, but the Secretary may
disapprove a site security plan if the plan fails to satisfy the risk-based
performance standards established by this section.7
Thus, DHS has statutory authority only to require attainment of the performance standard
that it sets, not to prescribe how a facility achieves attainment. Put another way, DHS
must accept any security measure that meets the applicable performance standard.
As noted above, the performance standard driving the PSP – RBPS #12 – is that regulated
facilities “[p]erform appropriate background checks on and ensure appropriate credentials
for facility personnel, and as appropriate, for unescorted visitors with access to restrictedareas or critical assets, including . . . [m]easures designed to identify people with terrorist
ties.”8
This regulatory text does not itself mention the TSDB, or require facilities to submit any
information to DHS. It certainly does not require facilities to give DHS information so
that DHS can develop and maintain databases on which individuals have been to which
regulated facilities. The rule text only requires that facilities perform “appropriate”
background checks and ensure “appropriate” credentials “to identify people with terrorist
ties.”
DHS currently issues roughly a half-dozen credentials that require, as a condition of
issuance, that DHS check the applicant against the TSDB – most notably including the
Transportation Worker Identification Credential (TWIC) and the Hazardous Materials
Endorsement (HME) to a commercial drivers license. Moreover, DHS perpetually “vets”
these credentials against the TSDB so that it will discover if a holder subsequently is
added to the TSDB – it describes this as “a DHS best practice.”9
A great many of the contractors and visitors that may require access to a CFATS-
regulated facility possess one of these credentials. In our considered view, a facility has
satisfied its obligation under RBPS #12 if it determines that an individual possesses one
of them. We believe that any additional requirement for facilities to submit information
regarding these individuals to DHS is beyond DHS’s ability to compel, especially since
DHS already has the ability to vet these persons’ credentials on a continuing basis and, if
it gets a hit against the TSDB, to revoke the credential, alert the FBI so that it can place
the person under surveillance, etc. We do not believe DHS has the authority to enlist
regulated facilities as part of its scheme to track the comings and goings of people who
have had access to regulated facilities, in the highly unlikely event that one of them will
turn out, after having obtained a TWIC or similar credential, to have some terrorist tie. In
short, we not believe RBPS #12 currently empowers DHS to compel our members to
facilitate “a DHS best practice.” DHS noted these arguments in its third ICR notice, but
its responses are utterly non-responsive.10
Thus – at least with respect to individuals who possess credentials like the TWIC or
HME – the PSP is not “necessary for the proper performance of the functions of the
agency,” and cannot be approved under the PRA.11 If DHS believes it has the statutory authority to mandate as specific a performance measure as the PSP, it needs to go through rulemaking to seek to amend its CFATS performance standards to specifically require that action.
II. The Proposed PSP Is Unnecessarily Duplicative
As just explained, many of the individuals who will require access to CFATS-regulated
facilities possess DHS-issued credentials that are perpetually vetted by DHS against the
TSDB. With respect to these individuals, the PSP’s requirement that such facilities
collect and submit to DHS information about their credential serial numbers, expiration
dates, and (in the case of HMEs) issuing state is “unnecessarily duplicative of
information otherwise reasonably accessible to the agency.”12 For this reason as well,
OMB should disapprove the ICR.
III. DHS Has Not Followed the PRA and OMB’s Implementing Rules
The PRA generally requires federal agencies proposing a new collection of information
to provide the public 60-days notice of the proposed collection, with comments to be
submitted to the agency,13 and upon submission of the proposed collection to OMB, to
give the public an additional 30-day opportunity to provide comments to the agency “and
the Director,” i.e., OMB.14
OMB’s implementing regulations reiterate these obligations: an agency must publish a
60-day notice as part of its own review,15 and then must publish a 30-day notice
indicating that comments can be sent to the agency and “submitted to OMB.”16 The
reason for submission of comments to OMB is because OMB’s own rules require it to
“provide at least 30 days for public comment after receipt of the proposed collection of
information before making its decision. . . .”17
We cite Section 1320.12 of
OMB’s PRA rules because it governs collections associated with a current regulation, as
in the case of the PSP, but even if the PSP were considered a free-standing collection, the
relevant requirements would be the same. See id. § 1320.10(a) (“The notice shall direct
DHS has published three Federal Register notices regarding the PSP, but it has never
requested that comments be sent to OMB:
-
The first, published on June 10, 2009, was a PRA-compliant 60-day notice.18
-
The second, published on April 13, 2010, looked like the first notice. It repeated
the first notice’s statement that DHS “will be submitting the following
information collection request” to OMB.19 It gave the public 30 days to file
comments, but it directed them to be submitted exclusively to DHS,20 which made
sense at the time – what point would there be commenting to OMB on an ICR that
had not yet been submitted to it? The second notice also cited only Section
1320.8 of OMB’s PRA rules, which governs how agencies “shall review each
collection of information before submission to OMB. . . .”21 The notice spent a
great deal of time addressing comments that were filed on the first notice.22 The
general understanding of the regulated community at the time was that DHS was
conducting an additional round of notice and comment, since (i) the first notice
had been so short (only three pages) and (ii) DHS was now supplying so much
new information in its response to comments.
-
The third notice, published on June 14 of this year, is merely a response to
comments filed in response to the second notice – indeed, that is how it is
styled.23 While it announces that DHS “has submitted” the ICR to OMB,24 it does
not invite the public to submit comments to anyone. And if one checks the docket
for this ICR in Regulations.gov, where prior comments had been directed, one
sees that the docket is no longer open for comment.25
We appreciate your statement at our June 2 meeting that OMB would consider comments
on this ICR filed within 30 days of the publication date. Other potentially interested comments to the Office of Information and Regulatory Affairs of OMB, Attention: Desk
Officer for [name of agency].”).
members of the public are not necessarily aware of that possibility, however. And
OMB’s generous willingness to consider comments filed in response to the third notice
cannot excuse DHS’s failure to do as it was required: to invite the public to submit
comments to OMB on the ICR after its submission.
IV. The ICR Omits Information Essential to Estimating Burden
A fundamental part of an agency’s responsibility under the PRA is to invite public
comments on “the accuracy of the agency's estimate of the burden of the proposed
collection of information, including the validity of the methodology and assumptions
used.”26 Obviously, in order for the public to be able to do that, it must be provided with
information from which it can conduct its own estimates of burden. But DHS has
omitted crucially important information.
The core function of the PSP is to provide a web-based mechanism by which regulated
facilities can submit personally-identifying information regarding individuals seeking
access to restricted areas and critical assets at the facility.27 How burdensome this
requirement will be will depend in substantial part on two questions left unanswered by
DHS:
1. Whether this information has to be collected and submitted (and potentially
confirmation of receipt received) before the person can be granted access. Chemical
facilities frequently have important contractors and visitors arriving upon short or no
notice. They may require such people to come on site suddenly – for example, if a
production unit goes down or otherwise requires emergency maintenance. Our sectors
have proposed to DHS that it allow facilities to meet their “terrorist ties” screening
requirement by accepting Federal credential that require such screening to be issued (e.g.,
the TWIC), but DHS has steadfastly rejected this proposal and insisted on the submission
of additional information regarding such individuals.28
A requirement that the facility know the identity of the particular individuals who will or
may be arriving at the plant in advance would impose a substantial burden. In order to
maintain maximum flexibility, facilities would need to clear all such individuals as it
anticipates might conceivably need to come on site – likely many more than might
actually show up. For example, all technicians working for an electrical contractor, or all
truck drivers working for a delivery truck company, might need to be identified, in
coordination with those employers, and then their information submitted. This analysis
does not even begin to take into account the collateral or indirect effects on a plant of not
being able to clear someone as quickly as they are needed. Conceivably, a production unit might have to be shut down because the requisite minimum prior notice period had
not expired.
DHS had not previously alluded to a prior notification requirement in connection with the
PSP until the third notice was published last month. In that document, however, DHS
announced that it was going to require the submission of information on “new affected
individuals prior to access . . . .”29 It added that it was “considering whether to establish
that high-risk chemical facilities be required to submit the information at least 48 hours
prior to access. . . .”30 Whether DHS will actually implement this – or some other – prior
notice requirement has a potentially enormous effect on the burden that the PSP will
impose. But we do not know what DHS will do.
2. If information can be submitted after the fact, how often? The burden of
managing information collected under the PSP and submitting it to DHS will also vary
greatly depending on how often it has to be submitted: In real time? Daily? Weekly?
Monthly? Obviously, the more immediately the information must be submitted, the
greater the burden. This would particularly be true if submissions were due in real time
or daily, as the job would of necessity fall to the guards and other individuals collecting
the information. The more infrequent the submissions, the more likely the task could be
made the part-time responsibility of one or more IT staff.
But DHS has not provided this schedule. Its first notice was completely silent on the
topic. The second notice provided a “proposed schedule” that set out of 30-90 day
deadlines, depending on the risk-based tier of the facility.31 However, the third notice
implicitly rescinded this schedule, stating instead that, “[b]ased in part on commenters’
concerns, DHS will revise the proposed information submission schedule previously
published in the 30-day notice.”32 Given that one of the changes made “based in part on
commenters’ concerns” was to impose a prior notice requirement, we are not sanguine
that the revised schedule will not contain shorter deadlines. But we (and DHS) cannot
accurately estimate burden without knowing that schedule.
***
For the reasons explained above, OMB should disapprove this ICR and instruct DHS to
resubmit it (i) following the procedural requirements of the PRA and OMB’s rules and
(ii) suitably narrowed to meet the substantive requirements of the PRA.
Sincerely,
Agricultural Retailers Association
American Coatings Association
Chemical Producers and Distributors Association
Compressed Gas Association
CropLife America
Institute of Makers of Explosives
International Institute of Ammonia Refrigeration
International Liquid Terminals Association
National Association of Chemical Distributors
National Petrochemical and Refiners Association
Society of Chemical Manufacturers and Affiliates
The Chlorine Institute
The Fertilizer Institute
1 76 Fed. Reg. 34720 (June 14, 2011).
2 The development of these comments was supported by the Society of Chemical Manufacturers and Affiliates.
3 See 72 Fed. Reg. 17688, 17733 (Apr. 9, 2007).
4 6 C.F.R. § 27.230(a)(12).
5 76 Fed. Reg. 34721.
6 Pub. L. No. 109-295, § 550(a), 6 U.S.C. § 121 note. 7 Id.
8 6 C.F.R. § 27.230(a)(12).
9 76 Fed. Reg. 34723-24.
10 See id. at 34730.
11 See 44 U.S.C. § 3508 (“Before approving a proposed collection of information, the Director shall determine whether the collection of information by the agency is necessary for the proper performance of the functions of the agency . . . .”). Cf. OMB, THE PAPERWORK REDUCTION ACT OF 1995: IMPLEMENTING GUIDANCE 38 (Preliminary draft Feb. 3, 1997) (“The term ‘need’ means that some programmatic or policy requirement (as opposed to a desire for information . . .) exists.”).
12 Id. at § 3506(c)(3)(B); cf. PAPERWORK REDUCTION ACT GUIDANCE, supra at 40 (“The term ‘unnecessary duplication’ means that information similar to or corresponding to information that could serve the agency’s purpose and need is already accessible to the agency.”).
13 44 U.S.C. § 3506(c)(2)(A).
14 Id. § 3507(a)(1)(D)(ii)(VI).
15 5 C.F.R. § 1320.5(a)(1)(i), § 1320.8(d).
16 Id. § 1320.5(a)(1)(iv)(B)(6).
17 Id. § 1320.12(d). The only exception to this rule is in the case of emergency collections, not relevant here. Id.; see also § 1320.13.
18 See 74 Fed. Reg. 27555 (citing 5 C.F.R. § 1320.8 and giving the public 60 days to submit comments to DHS).
19 See 75 Fed. Reg. 18850.
20 Id.
21 Id.; see 5 C.F.R. § 1320.8.
22 See 75 Fed. Reg. 18852-18856.
23 See 76 Fed. Reg. 34720 (“Action: Response to comments received during 30-day comment period: New information collection request 1670-NEW”).
24 Id. at 34721.
25 Go to http://www.regulations.gov/#!docketDetail;dct=FR+PR+N+O+SR;rpp=10;po=0;D=DHS -2009-0026.
26 5 C.F.R. § 1320.8(d)(1)(ii).
27 76 Fed. Reg. 34721.
28 Id. at 34723-24.
29 Id. at 34724.
30 Id.
31 See 75 Fed. Reg. 18852-53. 32 76 Fed. Reg. 34724.