Today CISA published a 60-day information collection request (ICR) revision notice in the Federal Register (89 FR 74975-74977) for “Revision of a Currently Approved Information Collection for
Chemical-Terrorism Vulnerability Information (CVI)”. CVI is the data protection regime for the Chemical Facility Anti-Terrorism Standards (CFATS) program. While CISA acknowledges that the authority to operate the CFATS program expired on July 28th, 20223, today’s notice explains:
“It is the Administration's position that CFATS should be reauthorized. However, even without statutory reauthorization, there is both a reason to continue collecting this information (i.e., enabling individuals with a need to know but who are not CVI Authorized Users to access historical government records safeguarded as CVI) as well as existing statutory authority to do so under 6 U.S.C. 652(e)(1)(J) [link added]. Once CFATS is reauthorized, the training and application to become a CVI Authorized User will be made accessible to the public.”
There is no change in the burden estimate for responses or burden hours, as can be seen in the table below.
The change in the burden cost estimate is due to updating the Site Security Officers (SSOs) average wage figure.
Burden Estimate
In today’s notice, CISA provides a burden history for the last three full calendar years of the CFATS program, providing the numbers of personnel who had submitted a request to become a CVI Authorized User Number annually.
The average annual burden history (12,876) is significantly lower than the proposed burden. CISA explains that:
“Due to past fluctuations and uncertainty regarding the number of future respondents, CISA believes that 20,000 continues to be a reasonable estimate when CFATS is reauthorized. Therefore, CISA proposes to retain the estimated annual number of respondents.”
Historically, CISA has been using the 20,000 respondents figure since August 2017 when this ICR was reduced to a single information collection, the Chemical-terrorism Vulnerability Information (CVI) Authorization. Prior to last July, CISA collected this information on the CVI website. When the current authorization for the CFATS program expired, CISA has been collecting this information via a .pdf document. CISA expects to reinstate the website collection once (if) the program is reauthorized by Congress.
While CISA expects that the CFATS program will be reauthorized, they acknowledge that the if that does not occur, the number of respondents will be much lower (they estimate 150 per year).
Public Comments
CISA is soliciting public comments on this ICR revision. Comments may be submitted via the Federal eRulemaking Portal (www.Regulations.gov; Docket # CISA-2024-0023). Comments should be submitted by November 12th, 2024.
Commentary
CISA has been steadfast in their belief that Congress will reinstate the CFATS program. This ICR is another example of that continued belief, even more than a year after the authorization expired. As the end of the 118th Congress quickly approaches, I am not sure that I share the same suspension of political reality that CISA is, at least publicly, showing in their continued support for this program. Sen Paul (R,KY) is not known for changing his positions or bowing to political pressure.
If we get to January 3rd, 2025 without the Senate approving HR 4470 (or extending the program through some legislative short cut like a spending bill provision or the NDAA), the Congress is going to have to start from scratch in the 119th. While a new CFATS bill could be as simple as HR 4470, if the Democrats gain control of the House and/or Senate in November (either is looking to be possible), it would be more likely that a reinstatement bill would include some chemical safety expansions of the CFATS provisions. That would call for some more hearings and hard-to-reach deals between the House Energy and Commerce Committee and the House Homeland Security Committee. It could take the better part of the two-year term of the 119th Congress to pass such legislation.