July 11, 2011

Kim Nelson
DHS Desk Officer
Office of Information and Regulatory Affairs
Office of Management and Budget, New Executive Office Building, Room 10236 725 17th Street, NW.
Washington, DC 20503

Re: DHS NPPD; Chemical Facility Anti-Terrorism Standards Personnel Surety Program -- ICR Reference No. 201105-1670-002

Dear Ms. Nelson:

The undersigned organizations represent a broad spectrum of the chemical and petrochemical industries. We thank you for meeting with representatives of several of our organizations on June 2 regarding this important DHS collection proposal. Now that DHS has officially submitted the collection to OIRA,1 we are writing to describe our very serious concerns with it. We urge OIRA to disapprove this collection for four reasons: (1) the proposed PSP is unnecessary for the proper performance of DHS’s functions; (2) the proposed PSP is unnecessarily duplicative; (3) DHS has not complied with the procedural requirements of the Paperwork Reduction Act (PRA) and OMB’s PRA regulations; and (4) DHS has failed to include within the ICR key facts without which it is impossible to assess the burden of DHS’s proposed collection.2

By way of background, the proposed collection would implement the “Personnel Surety Program” (PSP) that DHS has developed under its “Chemical Facility Anti-Terrorism Standards” (CFATS) regulations, issued in relevant part in 2007.3 The CFATS rules establish various risk-based performance standards (RBPS) that regulated chemical facilities are required to meet, which include RBPS #12: “Perform[ing] appropriate background checks on and ensure appropriate credentials for facility personnel, and as appropriate, for unescorted visitors with access to restricted areas or critical assets, including . . . [m]easures designed to identify people with terrorist ties.”4 The PSP is DHS’s proposed mechanism by which facilities must meet the RBPS #12 standard. The PSP would require facilities to submit to DHS personally-identifying information regarding individuals seeking access to restricted areas and critical assets at the facility. DHS would then arrange for these individuals to be checked against the FBI’s classified Terrorist Screening Database (TSDB).5

Our associations, and their member companies, have collaborated closely and cooperatively with DHS to stand up the CFATS program quickly and effectively. We have also actively supported legislation to reauthorize that program for years to come. We will continue to work with DHS toward our shared goals, including personnel surety. The currently proposed PSP is improved in some respects from what DHS previously described. On balance, however, and as explained below, compliance with the proposal will draw critical facility resources away from the task of implementing other aspects of the CFATS program and from securing facilities more generally.

I. The Proposed PSP Is Unnecessary for the Proper Performance of DHS’s Functions

The statutory authority under which DHS has issued the CFATS rules is a rider to an appropriations statute and is quite general – it provides merely that DHS “shall issue interim final regulations establishing risk-based performance standards for security of chemical facilities.”6 Importantly, however, it left the choice of security measures to the facility, so long as they satisfied the relevant standard: [S]uch regulations shall permit each such facility, in developing and implementing site security plans, to select layered security measures that, in combination, appropriately address the vulnerability assessment and the risk- based performance standards for security for the facility[; and] the Secretary may not disapprove a site security plan submitted under this section based on the presence or absence of a particular security measure, but the Secretary may disapprove a site security plan if the plan fails to satisfy the risk-based performance standards established by this section.7

Thus, DHS has statutory authority only to require attainment of the performance standard that it sets, not to prescribe how a facility achieves attainment. Put another way, DHS must accept any security measure that meets the applicable performance standard.

As noted above, the performance standard driving the PSP – RBPS #12 – is that regulated facilities “[p]erform appropriate background checks on and ensure appropriate credentials for facility personnel, and as appropriate, for unescorted visitors with access to restrictedareas or critical assets, including . . . [m]easures designed to identify people with terrorist ties.”8

This regulatory text does not itself mention the TSDB, or require facilities to submit any information to DHS. It certainly does not require facilities to give DHS information so that DHS can develop and maintain databases on which individuals have been to which regulated facilities. The rule text only requires that facilities perform “appropriate” background checks and ensure “appropriate” credentials “to identify people with terrorist ties.”

DHS currently issues roughly a half-dozen credentials that require, as a condition of issuance, that DHS check the applicant against the TSDB – most notably including the Transportation Worker Identification Credential (TWIC) and the Hazardous Materials Endorsement (HME) to a commercial drivers license. Moreover, DHS perpetually “vets” these credentials against the TSDB so that it will discover if a holder subsequently is added to the TSDB – it describes this as “a DHS best practice.”9

A great many of the contractors and visitors that may require access to a CFATS- regulated facility possess one of these credentials. In our considered view, a facility has satisfied its obligation under RBPS #12 if it determines that an individual possesses one of them. We believe that any additional requirement for facilities to submit information regarding these individuals to DHS is beyond DHS’s ability to compel, especially since DHS already has the ability to vet these persons’ credentials on a continuing basis and, if it gets a hit against the TSDB, to revoke the credential, alert the FBI so that it can place the person under surveillance, etc. We do not believe DHS has the authority to enlist regulated facilities as part of its scheme to track the comings and goings of people who have had access to regulated facilities, in the highly unlikely event that one of them will turn out, after having obtained a TWIC or similar credential, to have some terrorist tie. In short, we not believe RBPS #12 currently empowers DHS to compel our members to facilitate “a DHS best practice.” DHS noted these arguments in its third ICR notice, but its responses are utterly non-responsive.10

Thus – at least with respect to individuals who possess credentials like the TWIC or HME – the PSP is not “necessary for the proper performance of the functions of the agency,” and cannot be approved under the PRA.11 If DHS believes it has the statutory authority to mandate as specific a performance measure as the PSP, it needs to go through rulemaking to seek to amend its CFATS performance standards to specifically require that action.

II. The Proposed PSP Is Unnecessarily Duplicative

As just explained, many of the individuals who will require access to CFATS-regulated facilities possess DHS-issued credentials that are perpetually vetted by DHS against the TSDB. With respect to these individuals, the PSP’s requirement that such facilities collect and submit to DHS information about their credential serial numbers, expiration dates, and (in the case of HMEs) issuing state is “unnecessarily duplicative of information otherwise reasonably accessible to the agency.”12 For this reason as well, OMB should disapprove the ICR.

III. DHS Has Not Followed the PRA and OMB’s Implementing Rules

The PRA generally requires federal agencies proposing a new collection of information to provide the public 60-days notice of the proposed collection, with comments to be submitted to the agency,13 and upon submission of the proposed collection to OMB, to give the public an additional 30-day opportunity to provide comments to the agency “and the Director,” i.e., OMB.14

OMB’s implementing regulations reiterate these obligations: an agency must publish a 60-day notice as part of its own review,15 and then must publish a 30-day notice indicating that comments can be sent to the agency and “submitted to OMB.”16 The reason for submission of comments to OMB is because OMB’s own rules require it to “provide at least 30 days for public comment after receipt of the proposed collection of information before making its decision. . . .”17


We cite Section 1320.12 of OMB’s PRA rules because it governs collections associated with a current regulation, as in the case of the PSP, but even if the PSP were considered a free-standing collection, the relevant requirements would be the same. See id. § 1320.10(a) (“The notice shall direct 

DHS has published three Federal Register notices regarding the PSP, but it has never requested that comments be sent to OMB:

  • The first, published on June 10, 2009, was a PRA-compliant 60-day notice.18

  • The second, published on April 13, 2010, looked like the first notice. It repeated the first notice’s statement that DHS “will be submitting the following information collection request” to OMB.19 It gave the public 30 days to file comments, but it directed them to be submitted exclusively to DHS,20 which made sense at the time – what point would there be commenting to OMB on an ICR that had not yet been submitted to it? The second notice also cited only Section 1320.8 of OMB’s PRA rules, which governs how agencies “shall review each collection of information before submission to OMB. . . .”21 The notice spent a great deal of time addressing comments that were filed on the first notice.22 The general understanding of the regulated community at the time was that DHS was conducting an additional round of notice and comment, since (i) the first notice had been so short (only three pages) and (ii) DHS was now supplying so much new information in its response to comments.

  • The third notice, published on June 14 of this year, is merely a response to comments filed in response to the second notice – indeed, that is how it is styled.23 While it announces that DHS “has submitted” the ICR to OMB,24 it does not invite the public to submit comments to anyone. And if one checks the docket for this ICR in Regulations.gov, where prior comments had been directed, one sees that the docket is no longer open for comment.25

    We appreciate your statement at our June 2 meeting that OMB would consider comments on this ICR filed within 30 days of the publication date. Other potentially interested comments to the Office of Information and Regulatory Affairs of OMB, Attention: Desk Officer for [name of agency].”).



members of the public are not necessarily aware of that possibility, however. And OMB’s generous willingness to consider comments filed in response to the third notice cannot excuse DHS’s failure to do as it was required: to invite the public to submit comments to OMB on the ICR after its submission.

IV. The ICR Omits Information Essential to Estimating Burden

A fundamental part of an agency’s responsibility under the PRA is to invite public comments on “the accuracy of the agency's estimate of the burden of the proposed collection of information, including the validity of the methodology and assumptions used.”26 Obviously, in order for the public to be able to do that, it must be provided with information from which it can conduct its own estimates of burden. But DHS has omitted crucially important information.

The core function of the PSP is to provide a web-based mechanism by which regulated facilities can submit personally-identifying information regarding individuals seeking access to restricted areas and critical assets at the facility.27 How burdensome this requirement will be will depend in substantial part on two questions left unanswered by DHS:

1. Whether this information has to be collected and submitted (and potentially confirmation of receipt received) before the person can be granted access. Chemical facilities frequently have important contractors and visitors arriving upon short or no notice. They may require such people to come on site suddenly – for example, if a production unit goes down or otherwise requires emergency maintenance. Our sectors have proposed to DHS that it allow facilities to meet their “terrorist ties” screening requirement by accepting Federal credential that require such screening to be issued (e.g., the TWIC), but DHS has steadfastly rejected this proposal and insisted on the submission of additional information regarding such individuals.28

A requirement that the facility know the identity of the particular individuals who will or may be arriving at the plant in advance would impose a substantial burden. In order to maintain maximum flexibility, facilities would need to clear all such individuals as it anticipates might conceivably need to come on site – likely many more than might actually show up. For example, all technicians working for an electrical contractor, or all truck drivers working for a delivery truck company, might need to be identified, in coordination with those employers, and then their information submitted. This analysis does not even begin to take into account the collateral or indirect effects on a plant of not being able to clear someone as quickly as they are needed. Conceivably, a production unit might have to be shut down because the requisite minimum prior notice period had not expired.

DHS had not previously alluded to a prior notification requirement in connection with the PSP until the third notice was published last month. In that document, however, DHS announced that it was going to require the submission of information on “new affected individuals prior to access . . . .”29 It added that it was “considering whether to establish that high-risk chemical facilities be required to submit the information at least 48 hours prior to access. . . .”30 Whether DHS will actually implement this – or some other – prior notice requirement has a potentially enormous effect on the burden that the PSP will impose. But we do not know what DHS will do.

2. If information can be submitted after the fact, how often? The burden of managing information collected under the PSP and submitting it to DHS will also vary greatly depending on how often it has to be submitted: In real time? Daily? Weekly? Monthly? Obviously, the more immediately the information must be submitted, the greater the burden. This would particularly be true if submissions were due in real time or daily, as the job would of necessity fall to the guards and other individuals collecting the information. The more infrequent the submissions, the more likely the task could be made the part-time responsibility of one or more IT staff.

But DHS has not provided this schedule. Its first notice was completely silent on the topic. The second notice provided a “proposed schedule” that set out of 30-90 day deadlines, depending on the risk-based tier of the facility.31 However, the third notice implicitly rescinded this schedule, stating instead that, “[b]ased in part on commenters’ concerns, DHS will revise the proposed information submission schedule previously published in the 30-day notice.”32 Given that one of the changes made “based in part on commenters’ concerns” was to impose a prior notice requirement, we are not sanguine that the revised schedule will not contain shorter deadlines. But we (and DHS) cannot accurately estimate burden without knowing that schedule.


For the reasons explained above, OMB should disapprove this ICR and instruct DHS to resubmit it (i) following the procedural requirements of the PRA and OMB’s rules and (ii) suitably narrowed to meet the substantive requirements of the PRA.


Agricultural Retailers Association
American Coatings Association
Chemical Producers and Distributors Association
Compressed Gas Association
CropLife America
Institute of Makers of Explosives
International Institute of Ammonia Refrigeration
International Liquid Terminals Association
National Association of Chemical Distributors
National Petrochemical and Refiners Association
Society of Chemical Manufacturers and Affiliates
The Chlorine Institute
The Fertilizer Institute 

76 Fed. Reg. 34720 (June 14, 2011).
The development of these comments was supported by the Society of Chemical Manufacturers and Affiliates.
See 72 Fed. Reg. 17688, 17733 (Apr. 9, 2007).
6 C.F.R. § 27.230(a)(12).
76 Fed. Reg. 34721.
Pub. L. No. 109-295, § 550(a), 6 U.S.C. § 121 note. Id.
6 C.F.R. § 27.230(a)(12).
76 Fed. Reg. 34723-24.
10 See id. at 34730.
11 See 44 U.S.C. § 3508 (“Before approving a proposed collection of information, the Director shall determine whether the collection of information by the agency is necessary for the proper performance of the functions of the agency . . . .”). Cf. OMB, THE PAPERWORK REDUCTION ACT OF 1995: IMPLEMENTING GUIDANCE 38 (Preliminary draft Feb. 3, 1997) (“The term ‘need’ means that some programmatic or policy requirement (as opposed to a desire for information . . .) exists.”).

12 Id. at § 3506(c)(3)(B); cf. PAPERWORK REDUCTION ACT GUIDANCEsupra at 40 (“The term ‘unnecessary duplication’ means that information similar to or corresponding to information that could serve the agency’s purpose and need is already accessible to the agency.”).
13 44 U.S.C. § 3506(c)(2)(A).
14 Id. § 3507(a)(1)(D)(ii)(VI).
15 5 C.F.R. § 1320.5(a)(1)(i), § 1320.8(d).
16 Id. § 1320.5(a)(1)(iv)(B)(6).
17 Id. § 1320.12(d). The only exception to this rule is in the case of emergency collections, not relevant here. Id.; see also § 1320.13. 
18 See 74 Fed. Reg. 27555 (citing 5 C.F.R. § 1320.8 and giving the public 60 days to submit comments to DHS).
19 See 75 Fed. Reg. 18850.
20 Id.
21 Id.; see 5 C.F.R. § 1320.8.
22 See 75 Fed. Reg. 18852-18856.
23 See 76 Fed. Reg. 34720 (“Action: Response to comments received during 30-day comment period: New information collection request 1670-NEW”).
24 Id. at 34721.
25 Go to http://www.regulations.gov/#!docketDetail;dct=FR+PR+N+O+SR;rpp=10;po=0;D=DHS -2009-0026.
26 5 C.F.R. § 1320.8(d)(1)(ii). 
27 76 Fed. Reg. 34721.
28 Id. at 34723-24.
29 Id. at 34724.
30 Id.
31 See 75 Fed. Reg. 18852-53. 32 76 Fed. Reg. 34724.