This is part of a series of blog posts looking at the potential for the authorization of CISA’s existing ChemLock program and using it as a voluntary replacement for the now defunct Chemical Facility Anti-Terrorism Standards (CFATS) program. Other posts in this series include:
NOTE: Previous articles in this series have been removed from the CFSN Detailed Analysis paywall.
TSDB Screening
One of the more controversial elements of the CFATS program was the personnel surety process. Part of the risk based performance standards outlined in 6 CFR 27.230, DHS required facilities to perform “appropriate background checks on and ensure appropriate credentials for facility personnel, and as appropriate, for unescorted visitors with access to restricted areas or critical assets”. Three of the four requirements under this paragraph {§27.230(a)(12)} are relatively standard background checks performed by many businesses. The fourth requirement {§27.230(a)(12)(iv)} was more problematic: “Measures designed to identify people with terrorist ties”.
The only relatively comprehensive data base that could be used to satisfy that requirement is the Terrorist Screening Database (TSDB) maintained by the Transportation Security Administration (TSA). Unfortunately for the CFATS program, employers do not have access to the TSDB, even for the purposes of vetting employees at designated high-risk facilities.
Currently, there are ways that individuals can get screened to document their lack of ties to terrorists. Two programs familiar to readers here are the Transportation Workers Identification Credential (TWIC) and the Hazardous Materials Indorsement (HMI). In each case, individuals are trying to obtain federal vetting to allow them access critical facilities or critical materials. In both cases, congress mandated that TSA charge the individuals applying for the vetting a fee to recover the cost of the process.
Personnel Surety Issues
There was a great deal of industry opposition to the CFATS TSDB screening when DHS tried to stand up the fourth leg of the CFATS Personnel Surety Program (PSP). One of the first problems was that the Infrastructure Structure Compliance Division (ISCD, then the DHS component responsible for overseeing the CFATS program) did not use a rule making process to implement the program, but instead used the information collection request (ICR) process. ISCD noted that the regulatory requirement already existed, they were just implementing an information collection process to support that requirement.
I did a series of blog posts that discussed the formal industry comments on the proposed TSDB screening ICR. Two things stood out. First industry did not want the responsibility for collecting personal identification information from employees and then providing that information to ISCD/TSA; they did not want potential flashback for potential privacy violations. Secondly, they wanted assurances that, after bearing the onus of collecting and supplying the information, that they would be informed if the TSDB identified potential terrorist ties. ISCD noted that they were collecting most of the information already as part of their normal business processes. The response to concerns about facility notification were more nuanced, as I note here.
Lack of Current Screening
When the authorization for the CFAT program expired on July 27th, 2023, CISA’s authority to collect, process, and forward TSDB screening information also expired. To be sure, facilities could still use screening conducted under the TWIC and HMI programs as part of their internal personnel surety programs, but those programs were never intended to be used as part of a corporate PSP process.
In November of 2023, Kelly Murray, CISA Associate Director for Chemical Security, announced that: “Prior to the lapse in authority, CFATS identified more than 10 individuals with possible ties to terrorism over the lifetime of the Personnel Surety Program. Given that rate of vetting, CISA likely would have identified an individual with or seeking access to dangerous chemicals as a known or suspected terrorist at some point over the past four months.” That number would be even larger today.
Various chemical industry organizations have cited the lack of TSDB screening as one of the reasons that they support the reinstatement of the CFATS program. That is quite a turnaround from their initial opposition to the program.
ChemLock and Screening
There is currently no process within CISA’s voluntary chemical security program, ChemLock, that facilities could be used to conduct a similar TSDB screening process. One of the main reasons for this is that Congress needs to specifically authorize non-governmental use of the TSDB since much of the information included in the database comes from classified sources.
As part of the congressional authorization of the ChemLock program that I am advocating for here, Congress should include in that authorization the authority for CISA to process data from chemical facilities for screening against the TSDB. Since the ChemLock program is voluntary (and will have to remain that way if there is any chance for it to be authorized in the current congressional climate) the screening of employees for terrorist ties would also have to remain voluntary.
Having said that, as part of the Safety Act (6 USC 441 et seq) tie-in that I am arguing for here, facilities that are attempting to get Security Act certification from CISA would have to conduct TSDB vetting as part of the pre-requisite for that certification. Who would have to be vetted would be directly tied to the Tier ranking that I discussed in a previous post. Facilities would be allowed to identify specific chemical security zones within the facility, and anyone being authorized unaccompanied access to those zones would be required to have been vetted through the TSDB. Facilities identified as being at a Tier 5 (the lowest threat level, not previously covered by the CFATS program) would only be authorized to vet a limited number of people in critical positions described in their site security plan.