[House Hearing, 116 Congress]
[From the U.S. Government Publishing Office]


              SECURING OUR NATION'S CHEMICAL FACILITIES: 
               STAKEHOLDER PERSPECTIVES ON IMPROVING 
               THE CFATS PROGRAM

=======================================================================

                                 HEARING

                               BEFORE THE

                            SUBCOMMITTEE ON
                     CYBERSECURITY, INFRASTRUCTURE
                       PROTECTION, AND INNOVATION

                                 OF THE

                     COMMITTEE ON HOMELAND SECURITY
                        HOUSE OF REPRESENTATIVES

                     ONE HUNDRED SIXTEENTH CONGRESS

                             FIRST SESSION

                               __________

                             MARCH 12, 2019

                               __________

                            Serial No. 116-6

                               __________

       Printed for the use of the Committee on Homeland Security
                                     

[GRAPHIC NOT AVAILABLE IN TIFF FORMAT] 
                                     

        Available via the World Wide Web: http://www.govinfo.gov

                               __________
                               
                               
                  U.S. GOVERNMENT PUBLISHING OFFICE                    
36-395 PDF                  WASHINGTON : 2019                     
          
--------------------------------------------------------------------------------------
For sale by the Superintendent of Documents, U.S. Government Publishing Office, 
http://bookstore.gpo.gov. For more information, contact the GPO Customer Contact Center,
U.S. Government Publishing Office. Phone 202-512-1800, or 866-512-1800 (toll-free).
E-mail, po@custhelp.com                               
                               
                               

                     COMMITTEE ON HOMELAND SECURITY

               Bennie G. Thompson, Mississippi, Chairman
Sheila Jackson Lee, Texas            Mike Rogers, Alabama
James R. Langevin, Rhode Island      Peter T. King, New York
Cedric L. Richmond, Louisiana        Michael T. McCaul, Texas
Donald M. Payne, Jr., New Jersey     John Katko, New York
Kathleen M. Rice, New York           John Ratcliffe, Texas
J. Luis Correa, California           Mark Walker, North Carolina
Xochitl Torres Small, New Mexico     Clay Higgins, Louisiana
Max Rose, New York                   Debbie Lesko, Arizona
Lauren Underwood, Illinois           Mark Green, Tennessee
Elissa Slotkin, Michigan             Van Taylor, Texas
Emanuel Cleaver, Missouri            John Joyce, Pennsylvania
Al Green, Texas                      Dan Crenshaw, Texas
Yvette D. Clarke, New York           Michael Guest, Mississippi
Dina Titus, Nevada
Bonnie Watson Coleman, New Jersey
Nanette Diaz Barragan, California
Val Butler Demings, Florida
                       Hope Goins, Staff Director
                 Chris Vieson, Minority Staff Director
                                 
                                 
                                  ------                                

     SUBCOMMITTEE ON CYBERSECURITY, INFRASTRUCTURE PROTECTION, AND 
                               INNOVATION

                Cedric L. Richmond, Louisiana, Chairman
Sheila Jackson Lee, Texas            John Katko, New York, Ranking 
James R. Langevin, Rhode Island          Member
Kathleen M. Rice, New York           John Ratcliffe, Texas
Lauren Underwood, Illinois           Mark Walker, North Carolina
Elissa Slotkin, Michigan             Van Taylor, Texas
Bennie G. Thompson, Mississippi (ex  Mike Rogers, Alabama (ex officio)
    officio)
               Moira Bergin, Subcommittee Staff Director
           Sarah Moxley, Minority Subcommittee Staff Director
                            
                            
                            C O N T E N T S

                              ----------                              
                                                                   Page

                               Statements

The Honorable Cedric L. Richmond, a Representative in Congress 
  From the State of Louisiana, and Chairman, Subcommittee on 
  Cybersecurity, Infrastructure Protection, and Innovation:
  Oral Statement.................................................     1
  Prepared Statement.............................................     2
The Honorable John Katko, a Representative in Congress From the 
  State of New York, and Ranking Member, Subcommittee on 
  Cybersecurity, Infrastructure Protection, and Innovation:
  Oral Statement.................................................     3
  Prepared Statement.............................................     4
The Honorable Bennie G. Thompson, a Representative in Congress 
  From the State of Mississippi, and Chairman, Committee on 
  Homeland Security:
  Prepared Statement.............................................     9
The Honorable Sheila Jackson Lee, a Representative in Congress 
  From the State of Texas:
  Prepared Statement.............................................     9

                               Witnesses

Mr. Michael P. Wilson, PhD, MPh, National Director, Occupational 
  and Environment Health Program, Bluegreen Alliance:
  Oral Statement.................................................    12
  Prepared Statement.............................................    14
Mr. John S. Morawetz, Health and Safety Representative, 
  International Chemical Workers Union Council:
  Oral Statement.................................................    21
  Prepared Statement.............................................    22
Mr. Pamela Nixon, President, People Concerned About Chemical 
  Safety:
  Oral Statement.................................................    26
  Prepared Statement.............................................    28
Mr. Kirsten Meskill, Director, Corporate Security, BASF:
  Oral Statement.................................................    29
  Prepared Statement.............................................    31

                             For the Record

The Honorable John Katko, a Representative in Congress From the 
  State of New York, and Ranking Member, Subcommittee on 
  Cybersecurity, Infrastructure Protection, and Innovation:
  Statement of The Fertilizer Institute (TFI) and Agricultural 
    Retailers Association (ARA)..................................     5
  Statement of the Institute of Makers of Explosives.............     6

                                Appendix

Questions From Chairman Bennie G. Thompson for John S. Morawetz..    47
Questions from Chairman Bennie G. Thompson for Michael P. Wilson.    48
Questions from Chairman Bennie G. Thompson for Pamela Nixon......    49

 
SECURING OUR NATION'S CHEMICAL FACILITIES: STAKEHOLDER PERSPECTIVES ON 
                      IMPROVING THE CFATS PROGRAM

                              ----------                              


                        Tuesday, March 12, 2019

             U.S. House of Representatives,
                    Committee on Homeland Security,
                            Subcommittee on Cybersecurity, 
                                 Infrastructure Protection,
                                            and Innovation,
                                                    Washington, DC.
    The subcommittee met, pursuant to notice, at 10:09 a.m., in 
room 310, Cannon House Office Building, Hon. Cedric L. Richmond 
(Chairman of the subcommittee) presiding.
    Present: Representatives Richmond, Jackson Lee, Langevin, 
Rice, Katko, Walker, and Taylor.
    Also present: Representative Rogers.
    Mr. Richmond. Good morning. I want to welcome everyone to 
today's hearing on the Department of Homeland Security's 
Chemical Facility Anti-Terrorism Standards or CFATS as we call 
it. It's a regulatory program that helps secure the Nation's 
highest-risk chemical facilities.
    Congress has just over 1 year to reauthorize the CFATS 
program and I want to make one thing clear. This committee is 
committed to getting CFATS reauthorization done.
    Last month we heard from DHS and GAO and today we will hear 
from stakeholders who deal with CFATS on the ground. Hearing 
from people on the ground and do this on a daily basis is 
important to us.
    I understand how important the stability of CFATS program 
is to the chemical industry which is critical to my district's 
economy. I also know how important it is to have a program that 
keeps facilities safe and secure because my constituents are 
the people who live near these facilities, the employees who 
work at these facilities every day and the firefighters and 
police we call to respond to an emergency.
    At the full committee hearing last month we discussed 
opportunities to build on the progress that has been made on 
the existing CFATS program. Since CFATS was established, the 
number of high-risk chemical facilities has dropped by half.
    I believe, and DHS agreed, that there is an opportunity to 
take the data on how facilities are reducing risk and use it to 
develop voluntary best practices that other facilities could 
use to reduce risk.
    This will be a win-win for chemical facilities, local 
communities, and the taxpayer, making us all safer and letting 
DHS focus its limited resources on the highest-risk facilities.
    Unfortunately, we also heard about some of the areas where 
CFATS continues to fall short. The Department is still not 
making sure first responders and emergency planners have enough 
information or the right information about local CFATS 
facilities in their area. Six years after the disaster in West, 
Texas, this is simply unacceptable.
    Also--excuse me--also it is not clear to me that CFATS 
facilities are including employees in the development of site 
security plans, vulnerability assessments, or inspections as 
they are required to by law.
    Finally, if CFATS is going to be successful, we need to be 
sure that the program is taking all relevant factors into 
account to access--to assess risk. Otherwise, we can't trust 
that CFATS is truly capturing the Nation's highest-risk 
facilities.
    For example, right now, DHS does not consider whether the 
facility is located near a hospital, a school, a residential 
area, a military base, a power plant, or close to other 
chemical facilities. Any of these factors could make a facility 
a more attractive target or make an event even worse for the 
surrounding community.
    This is especially concerning to me because research shows 
that facilities with dangerous chemicals tend to be heavily 
concentrated in minority and low-income areas, meaning that we 
may be exposing our most vulnerable populations to a 
disproportionate share of chemical security risk.
    DHS should also do more to understand what it means to be 
high-risk and to use expertise of a broader group of 
stakeholders. Overcoming the information-sharing challenges 
will require us to rethink how we restrict access to certain 
information deemed sensitive to National security.
    Although I am sensitive to the tension between security and 
transparency, it cannot be a barrier to better security or used 
to prioritize the security of some over others. I know many of 
our panelists have first-hand experience with many of these 
concerns and I look forward to hearing your perspectives.
    [The statement of Chairman Richmond follows:]
                Statement of Chairman Cedric L. Richmond
                             March 12, 2019
    Congress has just over 1 year to reauthorize the Chemical Facility 
Anti-Terorirism Standards (CFATS) program, and I want to make one thing 
clear: This committee is committed to getting reauthorization across 
the finish line.
    Last month we heard from DHS and GAO, and today we will hear from 
stakeholders who deal with CFATS on the ground.
    My district in Louisiana is home to more than 20 CFATS facilities. 
I understand how important the stability of the CFATS program is to the 
chemical industry, which is critical to my district's economy. Without 
regulatory stability, I am concerned CFATS facilities will not make 
strategic security investments, which is bad for business and bad for 
my community. I also represent the people who live near these 
facilities, the employees who work at these facilities every day, and 
the fire fighters and police we would call to respond to an emergency.
    In short, reauthorizing CFATS is critical for every stakeholder 
communities like mine--from facility owners and employees to 
surrounding communities and first responders.
    At the full committee hearing last month, we discussed 
opportunities to build on the progress that has been made under the 
existing CFATS program. Since CFATS was established, the number of 
``high-risk'' chemical facilities has dropped by half. I believe--and 
DHS agreed--that there is an opportunity to take the data on how 
facilities are reducing risk and use it to develop voluntary best 
practices that other facilities could use to buy down risk. This would 
be a win for chemical facilities, local communities, and the taxpayer--
making us all safer, and allowing DHS to focus its limited resources on 
the highest-risk facilities.
    Unfortunately, we also heard about some of the areas where CFATS 
continues to fall short.
    The Department is still not making sure first responders and 
emergency planners have enough information--or the right information--
about local CFATS facilities in their area.
    Six years after West, Texas, this is simply unacceptable.
    Further, it is not clear to me that CFATS facilities are including 
employees in the development of site security plans, vulnerability 
assessments, or inspections--as they are required to do by law.
    I am proud of the panel we have assembled here today and look 
forward to hearing our witness' perspectives on how we can address some 
of the program's shortcomings. We have panelists who know what it's 
like to respond to an emergency at a chemical facility without knowing 
what chemicals are on-site or how to handle them. We have panelists who 
will be able to tell us what it's like to live in the shadow of one or 
more of these high-risk facilities, and the difficulty communities have 
when it comes to preparing for and understanding the dangers those 
facilities present. And we have panelists who know what it's like to 
work in a high-risk facility--but do not have a seat at the table when 
executives are making decisions about security.
    Right now, it appears there are a number of relevant factors DHS is 
not including in its analysis. DHS does not consider whether the 
facility is located near a hospital, a school, a residential area, a 
military base, a power plant, or proximity to other chemical 
facilities. Any of these factors could make a facility a more 
attractive target, or intensify the consequences of an event to the 
surrounding community. If CFATS is going to be successful, we need to 
be sure that the program is taking all relevant factors into account to 
assess risk. Otherwise, we can't trust that CFATS is truly capturing 
the Nation's highest-risk facilities.
    Moreover, research shows that facilities with dangerous chemicals 
tend to be heavily concentrated in minority and low-income areas, 
meaning that we may be exposing our most vulnerable populations to a 
disproportionate share of chemical security risks.
    DHS should also do more to understand what it means to be ``high-
risk'' and to leverage the expertise of a broader group of 
stakeholders. Overcoming information-sharing challenges will require us 
to rethink how we restrict access to certain information deemed 
sensitive to National security.
    Although I am sensitive to the tension between security and 
transparency, it cannot be a barrier to better security, or used to 
prioritize the security of some over others.
    I hope to hear your thoughts on how we might strike that balance, 
and I look forward to your testimony.

    Mr. Richmond. With that, I will recognize our Ranking 
Member Mr. Katko.
    Mr. Katko. Thank you, Mr. Chairman. Thank you for holding 
this important hearing today.
    Welcome to all the witnesses here.
    As this is my first hearing as Ranking Member of this 
subcommittee, I just want to tell the Chairman that I look 
forward to working with him and all the Members of this 
subcommittee to improve our cybersecurity and protect our 
Nation's critical infrastructure.
    Cybersecurity is one of the great threats of our time and 
that's why it's such a high honor to be on this committee.
    A long-term reauthorization of the CFATS is a crucial 
component of this subcommittee's work to protect our 
infrastructure and in that regard I completely agree with the 
Chairman.
    CFATS began in 2007 as a program aimed at keeping dangerous 
chemicals out of the hands of terrorists. Since then, it has 
evolved into a comprehensive, effective program that provides 
chemical facilities with the flexibility to implement security 
standards appropriate to mitigate their facility's level of 
risk.
    CFATS must continue to evolve in small ways to ensure 
chemical facilities are equipped to address evolving security 
risks. The current program is a strong foundation upon which to 
build. The collaborative nature of this program between the 
Department of Homeland Security and chemical facilities is a 
key part of its value.
    I believe that any changes to CFATS should preserve and 
encourage this inherent collaboration.
    In addition, the certainty that the 4-year authorization of 
the 2014 bill provided was a strong signal to both DHS and 
industry stakeholders to invest and improve the program. 
Prioritizing another long-term bill is key to the success of 
this program.
    As we look to reauthorize this program it is important that 
we hear from those involved and affected by the program. I 
appreciate GAO and DHS for providing their testimony last month 
on this topic and our witnesses for taking the time to be here 
this morning, and I thank you all for being here.
    I look forward to our discussion about the CFATS program 
and look forward to working with my colleagues on this 
committee and in the Senate to continue this important program.
    [The statement of Ranking Member Katko follows:]
                 Statement of Ranking Member John Katko
                             March 12, 2019
    Mr. Chairman, thank you for holding this important hearing today. 
As this is my first hearing as Ranking Member of this subcommittee, I 
look forward to working with you, and all the Members of this 
subcommittee, to improve our cybersecurity and protect our Nation's 
critical infrastructure.
    A long-term reauthorization of the Chemical Facilities Anti-
Terrorism Standards Program, or CFATS, is a crucial component of this 
subcommittee's work to protect our critical infrastructure.
    CFATS began in 2007 as a program aimed at keeping dangerous 
chemicals out of the hands of terrorists. Since then, it has evolved 
into a comprehensive, effective program that provides chemical 
facilities with the flexibility to implement security standards 
appropriate to mitigate their facility's level of risk.
    CFATS must continue to evolve in small ways to ensure chemical 
facilities are equipped to address evolving security risks. The current 
program is a strong foundation upon which to build.
    The collaborative nature of this program between the Department of 
Homeland Security and chemical facilities is a key part of its value. I 
believe that any changes to CFATS should preserve and encourage this 
collaboration.
    In addition, the certainty that the 4-year authorization of the 
2014 bill provided was a strong signal to both DHS and industry 
stakeholders to invest and improve the program. Prioritizing another 
long-term bill is key to the success of this program.
    As we look to reauthorize this program, it is important that we 
hear from those involved and affected by the program. I appreciate GAO 
and DHS for providing their testimony last month on this topic, and our 
witnesses for taking time this morning.
    I look forward to our discussion about the CFATS program and look 
forward to working with my colleagues on this committee and in the 
Senate to continue this important program.

    Mr. Katko. Before I yield back, Mr. Chairman, I ask for 
unanimous consent to submit statements for the record from the 
Fertilizer Institute and the Institute of Makers of Explosives.
    Mr. Richmond. Without objection.
    [The information follows:]
Statement of The Fertilizer Institute (TFI) and Agricultural Retailers 
                           Association (ARA)
                             March 12, 2019
    Thank you for holding today's hearing, entitled ``Securing Our 
Nation's Chemical Facilities: Stakeholders Perspectives on Improving 
the CFATS Program.''
    The Chemical Facility Anti-Terrorism Standards (CFATS) program 
provides an important framework to ensure facilities are taking 
appropriate steps to be secure. The Fertilizer Institute \1\ (TFI) and 
Agricultural Retailers Association \2\ (ARA) represent hundreds of 
facilities that are subject to the CFATS program because they 
manufacture, store, handle, and sell certain CFATS chemicals of 
interest (COI), such as anhydrous ammonia, ammonium nitrate, sodium 
nitrate, and potassium nitrate. These fertilizers are needed to feed 
the crops that feed the world. Fertilizer is a key ingredient in 
feeding a growing global population, which is expected to surpass 9.5 
billion people by 2050. Half of all food grown around the world today 
is made possible through the use of fertilizer.
---------------------------------------------------------------------------
    \1\ TFI represents the Nation's fertilizer industry, which includes 
companies that are engaged in all aspects of the fertilizer supply 
chain. TFI's full-time staff, based in Washington, DC, serves its 
members through legislative, educational, technical, economic 
information, and public communication programs. TFI's members play a 
key role in producing and distributing vital crop nutrients, such as 
nitrogen, phosphorus, and potassium. These products are used to 
replenish soils throughout the United States and elsewhere to 
facilitate the production of healthy and abundant supplies of food, 
fiber, and fuel. Fertilizer is a key ingredient in feeding a growing 
global population, which is expected to surpass 9.5 billion people by 
2050. Half of all food grown around the world today is made possible 
through the use of fertilizer.
    \2\ ARA is a not-for-profit trade association that represents the 
Nation's agricultural retailers and distributors. ARA members provide 
goods and services to farmers and ranchers which include: Fertilizer, 
crop protection chemicals, seed, crop scouting, soil testing, custom 
application of pesticides and fertilizers, and development of 
comprehensive nutrient management plans. Retail and distribution 
facilities are scattered throughout all 50 States and range in size 
from small family held businesses or farmer cooperatives to large 
companies with multiple outlets.
---------------------------------------------------------------------------
    TFI and ARA represent companies that include large billion-dollar 
production facilities and thousands of small agriculture retailers, the 
latter of whom interact directly with American farmers. Agricultural 
retail facilities provide essential agronomic services and sell a 
variety of products to farmers, including fertilizer. Overall, the U.S. 
fertilizer industry generates more than $154 billion in economic 
benefit annually and provides approximately 89,000 direct jobs and 
406,000 indirect jobs for a total of 495,000 U.S. jobs.
    DHS has estimated that over 3,500 facilities are presently subject 
to the CFATS program. TFI and ARA estimate that this includes as many 
as 1,500 fertilizer manufacturers and agricultural retail facilities, 
with retail facilities accounting for the overwhelming majority. The 
retail facilities are generally located in rural communities, interface 
directly with farmers and often have just 5-10 employees at a location.
    Under the CFATS program, the Department of Homeland Security 
identifies chemicals which present potential security concerns. As 
previously mentioned, included on this list are a few fertilizers, 
including ammonia, ammonium nitrate, sodium nitrate, and potassium 
nitrate.
    The safe and secure handling of fertilizers is a high priority for 
TFI, ARA, and our members. We actively participate in and sponsor 
numerous safety initiatives, including ResponsibleAg, TRANSCAER, and 
the Fertilizer Safety and Health Partners Alliance with the 
Occupational Safety and Health Administration (OSHA).
    ResponsibleAg--which is a joint effort between TFI and ARA--exists 
to enhance compliance by agricultural retailers with a variety of 
Federal regulations, including those administered by the Department of 
Homeland Security's CFATS program. Each participating facility receives 
a Federal regulatory compliance assessment. Any noted compliance 
deficiencies must be corrected by the facility before it may be 
designated as certified under the program. The assessments are then 
conducted every 3 years.
    ResponsibleAg is a voluntary, industry-driven initiative and most 
of the retail agribusiness industry participated in its formation. 
Since its creation over 4 years ago, approximately one-third of the 
industry has signed up to participate in the ResponsibleAg program. To 
date, over 2,568 facilities are registered with the ResponsibleAg 
program, over 1,365 of these facilities have been certified, 207 
auditors have been trained, and almost 2,661 audits have been 
completed. Approximately 50,000 risks have been identified and 
corrected at facilities across the Nation. We are very proud of this 
industry-led compliance program.
    In the context of the CFATS program, ResponsibleAg ensures 
facilities are taking the necessary steps to be secure. We believe it 
is appropriate for industry stewardship programs--such as 
ResponsibleAg, which is making positive contributions to the CFATS 
program--to be recognized in a reauthorization bill.
    As Congress works to reauthorize the CFATS program, we have the 
following recommendations.
   Recognition of industry stewardship programs.
   Maintain CFATS focus on-site security.
   Enhance transparency between DHS and the regulated 
        community. For example, DHS recently completed a process for 
        reclassifying facilities. As a result, some of our member 
        facilities were reclassified into a higher-risk classification. 
        What was not clear to some our members was the underlying basis 
        for the new categorizations. We believe this should be a more 
        transparent effort between DHS and individual facilities, 
        allowing for a more thorough discussion of the security risks 
        posed by individual facilities. This could ultimately bolster 
        the quality of site security plans.
   Any updates or modifications to Appendix A should be subject 
        to a comprehensive notice and comment rule making. Another 
        example of the need for increased transparency is the way DHS 
        utilizes Appendix A, the list of chemicals potentially subject 
        to the CFATS program. We have encountered some confusing rule-
        making interpretations, particularly how the program addresses 
        ammonium nitrate and ammonium nitrate mixtures. The uncertainty 
        regarding which mixtures are or are not subject to CFATS has 
        been the subject of many discussions, but has not been resolved 
        to the satisfaction of our members, owing to the limited 
        explanations received from DHS.
   Facility owner and operators should retain discretion to 
        determine how site security information is shared.
   The personnel surety program (PSP) should not be expanded to 
        risk groups Tier 3 and Tier 4. This would be an exponential 
        expansion of the program from the less than 200 facilities 
        presently covered to more than 3,500. TFI and ARA recommend 
        that Congress consider making PSP optional for Tier 3 and Tier 
        4.
    Thank you again for holding this hearing and for the opportunity to 
submit this statement. TFI and ARA strongly support efforts to enact a 
long-term reauthorization of the CFATS program, and look forward to 
working with the you.
                                 ______
                                 
           Statement of the Institute of Makers of Explosives
                                    March 12, 2019.
The Honorable Bennie Thompson,
Chairman, Committee on Homeland Security, U.S. House of 
        Representatives, Washington, DC 20515.
The Honorable Mike Rogers,
Ranking Member, Committee on Homeland Security, U.S. House of 
        Representatives, Washington, DC 20515.
    Dear Chairman Thompson and Ranking Member Rogers: On behalf of the 
Institute of Makers of Explosives (IME) and the commercial explosives 
industry, I respectfully submit the following information to provide 
you a clearer picture of the duplicative burden our industry faces from 
Department of Homeland Security's (OHS) regulations. First, however, I 
would like to thank you for your attention to reauthorizing the OHS 
Chemical Facility Anti-Terrorism Standards (CFATS) program and your 
efforts to preserve and improve this pivotal security program.
    Founded in 1913, IME is the safety and security association for the 
commercial explosives industry, a charge we do not take lightly, as 
evidenced by the industry's excellent track record. Our industry's 
dedication to continual improvement, in conjunction with the 
regulations set forth by the Bureau of Alcohol, Tobacco, Firearms, and 
Explosives (ATF), has resulted in an ever-increasing culture of 
security that has seen the use of regulated commercial explosives as 
components of improvised explosives devices in bombing incidents remain 
below 2 percent for the last 25 years, according to available ATF 
Explosives Incident Reports (EIRs). IME takes an active role in 
promoting responsible practices through the full life cycle of 
commercial explosives and regularly publishes, updates, and distributes 
free of charge, our series of Safety Library Publications (SLPs), 
including SLP 27 Security in Manufacturing, Transportation, Storage and 
Use of Commercial Explosives, to the benefit of our workers and the 
general public.
    On February 27, 2019, the committee held the first oversight 
hearing of the 116th Congress on the CFATS program and took concrete 
steps toward ensuring the security of our nation's chemical facilities. 
IME, along with our partners in the CFATS Coalition, strongly supports 
the reauthorization of the program and believes that a bi-partisan and 
bi-cameral reauthorization process will result in a robust program that 
enhances national security while reducing regulatory uncertainty and 
undue burden to industry.
    During the hearing, David Wulf, Director of DHS' Infrastructure 
Security Compliance Division, was asked about OHS regulations that 
resulted in duplicative regulation on industry germane to the CFATS 
program. IME believes that while Director Wulf's answer that CFATS is 
``in all cases bringing something additional to the table'' was made in 
good faith, it neglected to address the unique and superfluous impact 
of the program on materials that have been successfully regulated by 
the Bureau of Alcohol, Tobacco, Firearms, and Explosives (ATF) for 
nearly 50 years, namely commercial explosives.
    In fact, contrary to what one would expect from a new regulatory 
program, the commercial explosives industry did not experience a 
significant drop in thefts because of CFATS requirements. Instead, data 
obtained from the ATF's U.S. Bomb Data Center (USBDC) reveals a 
continuation of a trendline started in the 1980's that has seen thefts 
of commercial explosives drop from 191 thefts in 1988 to 15 in 2017, as 
shown in Figure 1 (right). While IME respects DHS' position that CFATS 
is a perceived value add, we question whether they can provide 
supporting evidence to quantity the magnitude of this value.
[GRAPHIC NOT AVAILABLE IN TIFF FORMAT]

    The impressive and consistent progress by the industry in reducing 
thefts validates not only the effective regulation of commercial 
explosives security by ATF for nearly 5 decades, but also the 
industry's commitment to continually improving security. On this point, 
after the tragic events of 9/11, IME members worked directly with 
Congress to draft the Safe Explosives Act of 2002, which implemented 
background checks for all persons receiving explosives, restricted the 
availability of explosives to prohibited persons, strengthened 
licensing and permitting requirements and aided in the fight against 
terrorism. The industry proudly works with the ATF to improve security 
wherever possible and is pleased to see the results of this partnership 
and on-going commitment to security of commercial explosives.
    While the duplicative CFATS program may not have significantly 
improved the security of our previously regulated industry, it has 
significantly impacted, in a negative way, industry resources. The 
commercial explosives industry has approximately 30 facilities 
throughout the country that are regulated under CFATS. The compliance 
costs to these sites for 2018 alone reached over $1.7 million. There is 
no data that shows that these costs required to comply with CFATS have 
resulted in an increase in security over the course of the program. The 
CFATS program may help the broader chemical sector improve security, 
but the evidence shows that ATF, in concert with the commercial 
explosives industry's best practices, has had increasing success in 
mitigating explosives thefts since long before 2007 and the 
implementation of CFATS.
    IME respectfully disagrees with Director Wulf's assertion that the 
program is ``in all cases bringing something additional to the table'' 
and would like DHS to quantify their statement. The inability of DHS to 
provide metrics to substantiate the value of CFATS to the previously 
regulated explosives industry coupled with the USBDC's comprehensive 
data to the contrary, makes an exemption for ATF-regulated materials to 
the CFATS program a clear opportunity to make impactful and sensible 
reform without having an adverse effect on national security.
    As a matter of fact, Director Wulf did, during the 115th Congress, 
indicate that the industry's record of security is appropriate to 
safeguard commercial explosives from terrorists. On June 12, 2018, 
during a Senate Homeland Security & Governmental Affairs Committee 
round table--Examining the Chemical Facility Anti-Terrorism Standards 
Program, when asked about an exemption for facilities regulated by ATF, 
Wulf responded that he ``would not lose sleep if they exited the 
program. . . .'' Forty-eight hours later, Director Wulf reinforced this 
position when testifying before the House Energy & Commerce 
Subcommittee on the Environment at a hearing titled The Chemical 
Facilities Anti-Terrorism Standards Program (CFATS)--A Progress Report. 
In response to a similar question from Congressman Jeff Duncan, 
Director Wulf reiterated that explosives are ``among the things that I 
would not lose too much sleep over exiting the program''. This is, in 
DHS' own words, a testament to the effectiveness of ATF regulation and 
industry stewardship, and soundly reinforces the feasibility of an 
exemption for commercial explosives in the CFATS program.
    For the reasons explained above, IME requests an exemption for 
explosive materials regulated by the Bureau of ATF from the duplicative 
CFATS regulations be included in the next CFATS reauthorization bill 
the Committee drafts. Specifically, Congress should amend 6 U.S.C. 
Chapter 1, Subchapter XVI, Chemical Facility Anti-Terrorism Standards, 
Section 621(4) to include as an excluded facility ``(F) a business 
premises where explosive materials are manufactured, imported, stored 
or distributed subject to the regulation of the Department of Justice, 
Bureau of Alcohol, Tobacco, Firearms, and Explosives, under 18 U.S.C. 
Chapter 40 and 27 CFR Part 555.
    If I can be of any assistance or can provide data that will help 
you make a decision on this issue, please contact me[.]
            Respectfully,
                                               John Boling,
                              Vice President of Government Affairs.

    Mr. Katko. With that, I yield back.
    Mr. Richmond. I will now recognize the Ranking Member of 
the full Homeland Security Committee, Mr. Rogers.
    Mr. Rogers. Thank you, Mr. Chairman.
    As you have heard the Chairman and Ranking Member 
emphasize, CFATS is a critically important country--program to 
our country. In the past, Republicans and Democrats have worked 
together to reauthorize CFATS and make the program--with 
improvements.
    I hope that tradition of bipartisanship on this issue can 
continue. I believe that with bipartisan, bicameral process we 
can quickly move a long-term reauthorization of CFATS to the 
President's desk. I look forward to working collaboratively 
with the Majority and the Senate and the stakeholders and DHS 
to reauthorize the CFATS program.
    I look forward also to this hearing and today's witnesses.
    Mr. Rogers. With that, I yield back, Mr. Chairman.
    Mr. Richmond. Thank you to the Ranking Member of the full 
committee. Other Members are reminded that statements may be 
submitted for the record.
    [The statements of Chairman Thompson and Honorable Jackson 
Lee follow:]
                Statement of Chairman Bennie G. Thompson
                             March 12, 2019
    The perspectives we will hear today are often underrepresented in 
conversations about how to improve this important anti-terrorism 
program, and I am proud we have given them a seat at the table.
    Last month, the full committee received testimony from both the 
Department of Homeland Security and the Government Accountability 
Office to kick off our CFATS reauthorization efforts. The conversations 
at that hearing revealed 3 on-going challenges.
    No. 1: First responders still do not have the information they need 
to respond safely and effectively to an incident at a chemical 
facility. As a former volunteer fire fighter who fought to include 
first responder information access provisions in the CFATS Act of 2014, 
I am disturbed that gap still exists nearly 5 years after the West, 
Texas disaster.
    No. 2: DHS is not fully leveraging the data and lessons learned as 
facilities have tiered down or out of the CFATS program. DHS should use 
the information it collects and the experience of the regulated 
community to develop voluntary best practices to further reduce risk.
    Finally: The CFATS risk-tiering methodology does not appear to take 
into consideration the full spectrum of factors that should inform a 
facility's risk profile. For example, the CFATS' tiering methodology 
rigidly focuses on loss of life when evaluating the consequences of a 
release at a chemical facility. It fails to consider on-going health 
consequences, whether the facility is located next door to an 
elementary school or a nursing home, or whether neighboring structures 
might make the facility a more desirable terrorist target.
    DHS's failure to integrate this kind of information into its 
tiering methodology is particularly troubling because communities along 
a chemical facility's fence line tend to be poorer and have first 
responders who may not be well-resourced to respond to chemical 
facility disaster. I will be interested in hearing our witnesses' 
perspectives on these important points today.
    Another important priority I am glad we will have the opportunity 
to discuss today is facility engagement with its workforce. Despite 
provisions in the CFATS Act of 2014 requiring employee engagement on-
site security plans, I understand that the engagement Congress 
envisioned is not happening uniformly across the country. In some 
cases, it is not happening because employees are unaware that 
facilities are covered under CFATS in the first place. Facility 
employees are important force multipliers in keeping chemical 
facilities secure. And in the event of a disaster, facility employees 
are likely the people who will provide first responders with 
situational awareness critical to the response.
    In the past, this program has enjoyed broad, bipartisan support on 
and off the Hill. Every Secretary of Homeland Security from Secretary 
Chertoff to Secretary Nielsen has warned of threats posed by chemical 
weapons and has supported the CFATS program to make our communities 
safer and more secure.
    I will remind everyone here that we have only until April 2020 to 
reauthorize this important program. As Chairman, I am committed to 
getting a CFATS reauthorization package across the finish line. But as 
I made clear at the CFATS hearing last month, reauthorization will not 
become an excuse to water down the program.
    I look forward to working with my colleagues to get CFATS 
reauthorization done, and I look forward to the testimony from our 
witnesses today.
                                 ______
                                 
               Statement of Honorable Sheila Jackson Lee
                             March 12, 2019
    Chairman Bennie G. Thompson, and Ranking Member Mike Rogers, for 
holding today's hearing on ``Securing Our Nation's Chemical Facilities: 
Stakeholder Perspectives on Improving the CFATS Program,'' which 
affords the committee the opportunity to hear from non-Government 
chemical facility security stakeholders.
    Today's hearing will give Members an opportunity to hear from non-
Government witnesses in advance of CFATS reauthorization in April 2020.
    I thank today's witnesses for their testimony before this 
subcommittee:
   Major General Randy E. Manner (Retired), U.S. Army, former 
        acting director of the Defense Threat Reduction Agency;
   Dr. Michael Wilson, national director of occupational and 
        environmental health program, Blue Green Alliance;
   John Morawetz, health and safety representative, 
        International Chemical Workers Union Council (ICWUC);
   Pamela Nixon, president, People Concerned About Chemical 
        Safety (PCACS); and
   Kirsten Meskill, director of corporate security, BASF 
        (Minority witness).
    The CFATS program was established in response to warnings from 
security experts, including former Homeland Security Secretary Michael 
Chertoff, of credible terrorist threats to U.S. chemical plants.
    As a stop-gap measure Congress added the CFATS program to a fiscal 
year 2007 appropriations rider, which granted DHS temporary authority 
to run the program.
    DHS was authorized to administer the CFATS regulatory program that 
required high-risk chemical plant owners and operators to adhere to a 
set of security standards and adopt preventative measures to address 
on-site vulnerabilities.
    National security experts, former President Obama, and every 
Secretary of Homeland Security from Chertoff to Nielsen have warned 
that facilities with large amounts of hazardous chemicals are rich 
targets for terrorists, who could steal, release, or exploit such 
chemicals to inflict harm.
    Keeping CFATS linked to the appropriations cycle meant that the 
NPPD Office of Infrastructure Protection's Infrastructure Security 
Compliance Division (ISCD), has struggled to make strategic 
investments, retain staff, and develop policies to sustain the program.
    Overall, CFATS has made the country safer. Most covered facilities 
are implementing security measures to reduce risk, DHS is working more 
effectively with interagency partners like the EPA and OSHA, and the 
number of high-risk facilities has dropped by half--from over 7,000 in 
2007 to roughly 3,300 today.
    In 2011, a leaked internal memo prompted a series of Congressional 
hearings and investigations when it revealed major issues in ISCD's 
ability to hire and train personnel, process facility applications, and 
carry out timely inspections.
    Congressional inaction was upended by the April 2013, fertilizer 
plant explosion in West, Texas that killed 15 and wounded over 160 
others--many of the dead were first responders.
    The U.S. Chemical Safety and Hazard Investigation Board (CSB) 
investigation into the West, Texas incident revealed gaps in Federal, 
State, and local regulations about the handling and storing of 
hazardous materials.
    DHS had no knowledge of the facility, despite the fact that the 
facility had publicly reported threshold quantities of CFATS chemicals 
of interest to other Federal and State regulators, including the EPA's 
Risk Management Program (RMP).
    On December 18, 2014, the Protecting and Securing Chemical 
Facilities from Terrorist Attacks Act of 2014 (CFATS Act of 2014) 
authorized the CFATS program for 4 years.
    This law gave DHS the guidance and stability it needed to plan for 
the program's future by investing in better tools, personnel, and 
policy development efforts.
    Since 2014, ISCD has streamlined the facility submissions process, 
eliminated the backlog of unapproved SSPs, and performed compliance 
inspections for most of the regulated population.
    As a result, the majority of CFATS facilities have now moved from 
planning security measures to actually implementing them.
    DHS has reported that since the inception of the CFATS program, 
there has been a dramatic reduction in the overall number of ``high-
risk'' facilities throughout the country.
    This shift suggests that CFATS has actually been a driver in 
encouraging facilities to voluntarily reduce or remove chemical risks.
    The issue of great concern to me is the placement of chemical 
facilities in areas that may be impacted by severe weather events, such 
as was the case with Hurricane Harvey which struck the Houston area in 
2017.
    During the storm and the subsequent flooding of an organic 
peroxides factory, in the Houston-area operated by Arkema, Inc,. in a 
facility located in Crosby, Texas, experienced a power outage and 
inundation by flood water.
    Organic peroxides are reactive chemicals and can be dangerous if 
mistreated or mishandled.
    Proper storage is critical to the safe handling and use of organic 
peroxides, particularly those requiring controlled temperature storage.
    Storage should be between below 100 Farenheit however the 
RECOMMENDED storage temperature is below 86 Farenheit and if this is 
not maintained, uncontrolled decomposition can occur.
    The temperature controls for the organic peroxides kept by Arkema, 
Inc., at the time of Hurricane Harvey lost its temperature control 
systems, which resulted in a major leak and explosions.
    The Arkema Inc.'s organic peroxide facility was constructed on a 
100-year flood plain in 2007.
    But its emergency response plan, revised as recently as 2016, 
offers little direction for containing flood waters.
    A copy of the plan reviewed by the Associated Press says simply 
that ``care shall be taken to be sure water is kept out'' of buildings.
    A log Arkema kept of workers' efforts to safeguard the plant did 
not mention any effort to relocate its organic peroxides given the 
forecast anticipated over 50 inches of rain.
    The U.S. Chemical Safety Board determined that Arkema's facility 
was not prepared for such heavy rainfall.
    Given that climate change has and will continue to have 
unpredictable episodes of extreme weather events, it is important that 
plans for chemical facilities take into consideration conditions that 
would pose a risk to the stability of products or processes.
    The CFATS Act of 2014 requires facilities with threshold quantities 
of ``chemicals of interest'' (COI) to register with DHS and use an on-
line tool to provide information on chemical holdings, processes, and 
other conditions on-site (referred to as a Top Screen).
    If DHS determines that the facility ``presents a high level of 
security risk,'' the facility must perform a Security Vulnerability 
Assessment and develop a Site Security Plan (SSP) that addresses 
vulnerabilities in alignment with 18 risk-based performance standards.
    I plan to reintroduce H.R. 68, from the 113th Congress that 
provides that no Federal funds may be used by the Secretary of Homeland 
Security to approve a site security plan for a chemical facility, 
unless the facility meets or exceeds security standards and 
requirements to protect the facility against acts of terrorism and 
incorporate in their plan coordination and engagement of local and 
State first responders.
    I want to work with the committee on steps that must be taken to 
limit risks identified by the Arkema Inc., experience when CFATS 
reauthorization is taken up by this committee.
    I will pursue several measures to address CFATS that include:
   Reintroduction of H.R. 68, a bill to provide for the 
        evaluation and adoption of proven safety measures that provides 
        for quantifiable data on the capacity of local first responders 
        to react and respond to worst-case scenarios of Risk Management 
        Planning.
   Introduction of a bill to evaluate the efficacy and 
        effectiveness of the safety measure of ``sheltering in place'' 
        with regard to civilian populations living in close proximity 
        to chemical facilities, storage, or transport capacity.
   Finally, I plan to introduce a measure to assess 
        environmental risk factors that can impact the safety and 
        stability of chemicals or chemical processing including an 
        assessment of proven safety measures such as alternatives 
        assessments that evaluate if Hydrofluoric acid is replaced with 
        Ionic Liquids or Solid Acids as a catalyst to report on how 
        this change would affect toxicity or flammability risks.
    I look forward to hearing from today's witnesses on their views of 
the Chemical Facility Anti-Terrorism Standards Program.
    Mr. Chair, I yield back.

    Mr. Richmond. I now welcome our panel of witnesses. Our 
first witness, Dr. Michael Wilson, is the national director for 
Occupational and Environmental Health at the BlueGreen 
Alliance. Prior to that, he served as the chief scientist with 
the California Department of Industrial Relations and he has 
also spent 13 years working as a first responder.
    Next, we will hear from John Morawetz, who is here on 
behalf of the International Chemical Workers Union Council of 
the United Food and Commercial Workers International Union, 
which represents 20,000 chemical workers in 32 States.
    Our third witness, Ms. Pamela Nixon, is the president of 
People Concerned About Chemical Safety, an organization that 
advocates for individuals and families of the Kanawha Valley 
Community of West Virginia, which is home to multiple high-risk 
CFATS facilities.
    Finally, we have Kirsten Meskill--I hope I pronounced that 
right--the director of Corporate Security for BASF Corporation, 
who is here testifying on behalf of the American Chemical 
Council, who also has a facility in the Second Congressional 
District of Louisiana.
    So without objection, the witnesses' full statements will 
be inserted into the record. I ask--now ask each witness to 
summarize his or her statement for 5 minutes beginning with Dr. 
Wilson.

STATEMENT OF MICHAEL P. WILSON, PH D, M PH, NATIONAL DIRECTOR, 
OCCUPATIONAL AND ENVIRONMENT HEALTH PROGRAM, BLUEGREEN ALLIANCE

    Mr. Wilson. Thank you, Chairman Richmond, Ranking Member 
Katko, and distinguished Members. My name is Mike Wilson. I am 
the national director for occupational and environmental health 
of the BlueGreen Alliance.
    We are a national coalition of 14 labor unions and 
environmental organizations that has been working together for 
over a decade to build our Nation's clean energy economy in 
ways that also create good jobs with family supporting wages 
and safe working conditions.
    On behalf of the BlueGreen Alliance and the millions of 
members and supporters our partners represent, I thank you for 
inviting me today.
    We believe CFATS should be reauthorized, but in doing so we 
urge Congress to take the opportunity to modernize it by 
strengthening its requirements in three areas: Emergency 
response, worker participation, and risk reduction. I will 
touch on each of these briefly.
    In the area of emergency response, CFATS gives authority to 
the Secretary to provide information to local and governments, 
and I quote, ``to help ensure that first responders are 
properly prepared and provided with the situational awareness 
needed to respond to security incidents at covered chemical 
facilities.''
    This is useful but it's not sufficient if the objective is 
to give firefighters the ability to respond effectively to an 
industrial chemical incident. As we know from the experience of 
the Emergency Planning and Community Right-to-Know Act or 
EPCRA, firefighters need much more than chemical information.
    They need to talk to the people who run the facilities in 
their jurisdiction. They need to get inside those facilities 
regularly to see how chemicals are stored and processed in 
order to imagine what could go wrong. They need to train side-
by-side with facility operators.
    This is pre-fire planning and it's crucial to a safe and 
effective response. It requires an on-going commitment by 
industry. That commitment, however, needs to be explicitly 
required under CFATS, more so than what is currently 
recommended within the non-mandatory risk-based performance 
standards.
    Because the fact is that except in an emergency, many 
facilities are reluctant to invite firefighters and other 
responders in to look around their property, let alone to pull 
out their equipment and conduct training.
    I speak to this based on my own 13 years of work as a 
professional firefighter, EMT, and paramedic during which time 
I responded to about 10,000 emergency calls, including to 
industrial chemical releases and fires. I can tell you that to 
do their job, firefighters need both information and access and 
they are like--they are more likely to get these if facilities 
are required to provide them on a routine basis under CFATS.
    Our second recommendation pertains to the role of front-
line workers in site security. The existing CFATS language on 
employee input is helpful but too generic to be effective. 
Depending on the inclinations of the facility, the term 
employee input can mean everything from a manager checking the 
box to get worker sign-off on a fully executed site security 
plan or it could mean a real seat for workers at management's 
decision-making table.
    In any case, the right of workers to participate 
meaningfully in site security decision making needs to be 
explicit in CFATS because just as they are reluctant to give 
routine access to firefighters, many facilities are reluctant 
to seriously involve front-line workers in decision making.
    Yet, industry itself recognizes that workers have a great 
deal of knowledge and experience to contribute. We suggest that 
you consider language from the 2017 process safety management 
regulations in California which require oil refineries to 
involve workers throughout all phases of process safety 
decision making.
    If adopted by CFATS, this type of language will help ensure 
that the insights of front-line workers are genuinely 
integrated into site security.
    Finally, our third recommendation pertains to risk 
reduction. CFATS is based on a risk management framework which 
assumes that dangerous chemicals used at a facility cannot be 
reduced or eliminated. So they have to be surrounded by layers 
of protection.
    Industry is far more innovative and clever than this, of 
course, and DHS has reported that under CFATS thousands of 
facilities have voluntarily taken action to reduce their use of 
dangerous chemicals by consolidating them from multiple sites 
into one or two sites, replacing a hazardous chemical with a 
less hazardous one, reducing the total quantity held on-site or 
switching to a less concentrated form.
    These approaches can make a facility much safer and they 
have the effect of reducing the desirability of the facility as 
a target of opportunity. CFATS could do more to encourage or 
require facilities to implement these types of approaches and 
we encourage you to make these changes during reauthorization.
    In closing, we know from the record and from the excellent 
work of the Chemical Safety Board that a major industrial 
chemical incident can devastate the lives of workers, 
communities, and entire communities. We urge you to use the 
reauthorization of CFATS as an opportunity to strengthen it in 
the ways we have described.
    So thank you, and I am glad to answer any questions you 
might have.
    [The prepared statement of Mr. Wilson follows:]
                Prepared Statement of Michael P. Wilson
                             March 12, 2019
    Thank you Chairman Richmond, Ranking Member Katko, and 
distinguished Members. My name is Michael Wilson, and I am the national 
director for occupational and environmental health at the BlueGreen 
Alliance. On behalf of my organization, our national labor and 
environmental partners, and the millions of members and supporters they 
represent, I want to thank you for convening the hearing today and for 
your continuing interest in chemical security.
    The BlueGreen Alliance's 14 member organizations represent 
thousands of workers in industrial facilities, as well as teachers, 
health care workers, construction workers, scientists, and citizens in 
communities across the country. Each one of our partners' members wants 
to come home at the end of the day and live in a safe community.
    As you contemplate changes to the Chemical Facility Anti-terrorism 
Standards (CFATS), we urge you to consider revisions that would 
motivate and require companies to meet three key objectives:
   Ensure a safe, effective emergency response to a major 
        industrial chemical incident;
   Provide for meaningful worker participation in security 
        planning and decision making; and,
   Implement risk reduction measures to limit the 
        attractiveness of chemical facilities as targets of 
        opportunity.
  i. cfats meets a critical need in protecting communities and workers
    In the context of CFATS, the stakes for communities and workers 
could not be higher. When I was serving as chief scientist in the 
California Department of Industrial Relations (DIR), I worked with U.S. 
EPA Region IX on strategies to prioritize the risks posed by chemical 
facilities in our State. One of the ways we did this was by looking at 
the ``worst-case scenario'' numbers that facilities submitted to EPA 
under the Risk Management Program (RMP) requirements. These numbers are 
estimates of the potential casualties that could result in the event of 
a catastrophic failure and loss of chemical containment at a facility.
    We found a concerning number of chemical facilities in California 
that reported potential casualties in the hundreds of thousands and 
above. These numbers resulted from a combination of factors, including:
   The health hazards and physical properties of the chemicals 
        used at the facility;
   The population density surrounding the facility; and,
   Local weather patterns, which might cause chemical vapors 
        released from a facility to travel into nearby neighborhoods 
        and beyond.
    I invite you to envision the implications, for example, of a major 
release of chlorine, which expands in air about 400 times when it's 
released from its container. Chlorine vapors are 3 to 4 times heavier 
than air, so they're capable of traveling close to the ground for miles 
from their point of release. Chlorine vapors convert to acid when 
inhaled into the lungs, which can produce pulmonary edema and even 
death at concentrations greater then 400 parts per million in air, 
which is the equivalent of 0.04 percent chlorine in air. Children are 
more vulnerable to the effects of pulmonary edema due to their smaller 
airways.
    As with chlorine, some of the most dangerous chemicals can produce 
life-threatening health effects even at very low exposure 
concentrations.
   ii. case study: the 2015 torrance, california refinery explosion 
             endangered the lives of thousands of residents
    We recently experienced a near-miss in California from a chemical 
whose effects are somewhat similar to those of chlorine. In 2015, an 
explosion occurred in the electrostatic precipitator at the oil 
refinery in the city of Torrance, near Los Angeles. The explosion sent 
tons of industrial dust into Torrance up to a mile away from the 
refinery, and the heavy metal debris that was blown off of the 
structure nearly struck a tank that contained tens of thousands of 
pounds of hydrofluoric acid (HF).
    Like chlorine, HF produces death through inhalation and pulmonary 
edema. The former chair of the U.S. Chemical Safety Board, Vanessa 
Sutherland, noted in the CSB press release related to this incident 
that ``hydrofluoric acid can pose a severe hazard to the population and 
environment if a release occurs. After HF acid vaporizes it condenses 
into small droplets that form a dense low-lying cloud that will travel 
along the ground for several miles and can cause severe damage to the 
respiratory system, skin, and bones of those who are exposed, 
potentially resulting in death.''\1\
---------------------------------------------------------------------------
    \1\ U.S. Chemical Safety and Hazard Investigation Board (CSB), U.S. 
Chemical Safety Board Finds Multiple Safety Deficiencies Led to 
February 2015 Explosion and Serious Near Miss at the Exxon Mobil 
Refinery in Torrance, California. January 13, 2016. Available online: 
https://www.csb.gov/us-chemical-safety-board-finds-multiple-safety-
deficiencies-led-to-february-2015-explosion-and-serious-near-miss-at-
the-exxon-mobil-refinery-in-torrance-california/.
---------------------------------------------------------------------------
    Given that 330,000 residents, 71 schools, and 8 hospitals are 
located within 3 miles of the refinery, the CSB concluded that the 
release had ``the potential to cause serious injury or death to many 
community members.''\2\ I invite you to contemplate thinking of 
Torrance as your place of residence in light of that statement.
---------------------------------------------------------------------------
    \2\ Ibid.
---------------------------------------------------------------------------
  iii. gao: many companies have not complied with the requirements of 
                                 cfats
    While most companies no doubt operate their facilities responsibly, 
it's also reasonable to expect that companies might find it difficult--
or at least time- and resource-intensive--to establish effective 
security measures that would protect against a deliberate act of 
industrial terrorism. Facility managers already face enormous demands 
to ensure that product moves safely in and out of the plant, so perhaps 
it's not a surprise that past GAO reports on the implementation of 
CFATS have found issues with facilities mis-reporting information to 
DHS (e.g., their ``Distance of Concern'') or failing to report to DHS 
at all.\3\
---------------------------------------------------------------------------
    \3\ U.S. Government Accountability Office (GAO), Nathan Anderson, 
Acting Director, Homeland Security and Justice, Testimony before the 
Committee on Homeland Security, House of Representatives. Critical 
infrastructure protection: Progress and Challenges in DHS's Management 
of Its Chemical Facility Security Program. GAO-19-402T. February 27, 
2019. Available on-line: https://www.gao.gov/assets/700/697117.pdf.
---------------------------------------------------------------------------
    The GAO did not speak directly to the notion of fraudulent 
reporting, but it highlighted the importance of supporting CFATS 
implementation with more direct oversight by DHS, including with 
enforcement actions and penalties as a matter of routine practice.
iv. congress should make changes to cfats in order to achieve at least 
                            three objectives
    I will now return to the 3 objectives noted above that we believe 
Congress should seek to achieve in revising CFATS:
Objective No. 1: Ensure a safe, effective emergency response to a major 
        industrial chemical incident
    In the area of emergency planning and response, CFATS must ensure 
that facilities have put in place--and routinely test--an effective 
emergency response plan for a major chemical incident.
    I'm familiar with the emergency response arena because I worked for 
13 years as a professional firefighter, paramedic, and EMT, during 
which time I responded to about 10,000 emergency calls, including to 
industrial facilities with chemical releases and fires. I also served 
with the U.S. Coast Guard Reserve for 7 years, and I was rostered for 
deployment for 5 years with FEMA Task Force 4, based out of the Oakland 
Fire Department, as part of FEMA's National Response System.
    In responding to industrial incidents in the fire service, we 
typically had very little information about chemicals inside the 
building. There was a lot of uncertainty, and I don't think we fully 
appreciated how little we understood about the potential risks we were 
facing at these incidents. At one industrial fire that occurred late at 
night, we were preparing to force open a door when an explosion 
occurred inside the building and a 55-gallon drum burst through the 
roof, landing in a nearby parking lot.
    On another occasion, a routine-sounding dispatch came in for ``a 
worker experiencing chest pain'' inside a vegetable processing plant, 
so when we arrived, we didn't feel the need to don our self-contained 
breathing apparatus (SCBA) to enter the building. Once we were deep 
inside the plant, however, we found that there were in fact several 
workers experiencing shortness of breath, chest pain, and nausea from a 
chlorine gas leak. We were no better protected than the workers we were 
attempting to help.
    Planning and responding effectively to an industrial chemical 
release is more complicated than it might sound. It requires much more 
than what is currently required under CFATS, which simply gives 
authority to the Secretary to share facility information with first 
responders in order to improve their ``situational awareness'' in 
responding to a chemical release.\4\
---------------------------------------------------------------------------
    \4\ Public Law 113-254, Protecting and Securing Chemical Facilities 
from Terrorist Attacks Act of 2014, Title XXI--Chemical Facility Anti-
Terrorism Standards. 6 USC 621, Section 2103, Protection and Sharing of 
Information, at (b) Sharing of Information with States and Local 
Governments, and at (c) Sharing of Information with First Responders. 
December 18, 2014. Available on-line: https://www.govinfo.gov/app/
details/PLAW-113publ254.
---------------------------------------------------------------------------
    While this CFATS requirement is marginally useful, it is far from 
sufficient. Even if the information is provided by facilities to the 
Secretary and transmitted to fire departments, it's difficult for 
firefighters to apply the information in actual response planning. The 
information--in and of itself--will be of limited value without 
additional facility-specific information, coordination, and training. 
For fire departments, chemical information about a facility is 
essential, but it is not enough to execute a safe and effective 
emergency response.
    To be useful to firefighters, information needs to be facility-
specific and continuously updated, and it needs to be part of a broader 
coordination, planning, and training effort between the facility and 
fire department. Firefighters need to train regularly with the facility 
in order to be capable of answering several questions in the event of a 
major chemical incident, including the following:
   The identity of the chemical involved in the release;
   The size of the release;
   The hazards and physical properties of the chemical;
   The physical lay-out of the plant, with points of access and 
        egress;
   The plume size, behavior, and direction;
   The possible health consequences of the release for the 
        public;
   Safe operating distances for firefighters and evacuation 
        distances for the public;
   Suppression, containment, and extinguishment practices;
   The potential for escalation to nearby vessels or piping;
   Appropriate personal protective equipment; and
   On-scene conditions, including actions taken by the facility 
        to contain and mitigate the release, numbers of persons injured 
        or trapped, and other associated hazards.
    These types of questions can only be answered by knowledge and 
experience gained through:
   Curated, facility-specific chemical information, as well as 
        information about the facility lay-out and structure;
   Regular planning and training with the facility;
   Appropriately-trained hazardous materials personnel;
   Proper personal protective equipment;
   Effective mutual aid systems; and
   Continuous on-plume modeling, evacuation management, and 
        hazardous materials operations.
    In short, an effective response requires much more than the 
transmission of chemical information to responders, as currently 
required--albeit indirectly--under CFATS.
            In practice, the emergency planning and response aspects of 
                    EPCRA and CFATS are similarly limited.
    CFATS appears to be following the model of the Federal Emergency 
Planning and Community Right-to-Know Act (EPCRA), which has been only 
marginally successful in improving emergency planning and response to 
major industrial incidents.
    Congress passed EPCRA in 1986 in response to the Bhopal disaster 
and other U.S. industrial chemical accidents. It consists of three 
major elements: The Toxics Release Inventory (TRI); an emergency 
planning provision; and a citizen suit provision.
    Under its emergency planning provisions, EPCRA requires facilities 
to provide chemical information to fire departments through Local 
Emergency Planning Committees (LEPCs) and State Emergency Response 
Commissions (SERCs)--or directly to fire departments--either by 
submitting copies of Material Safety Data Sheets (MSDS) or by providing 
a list of chemicals that are used and stored on-site. EPCRA requires 
the LEPCs to update this information annually, and to develop annual 
emergency response plans to be used during a major chemical incident. 
It requires facilities (under section 311) to submit an annual 
Emergency and Hazardous Chemical Inventory Form with information on how 
and where chemicals are stored on-site.\5\
---------------------------------------------------------------------------
    \5\ U.S. Environmental Protection Agency (EPA), ``Emergency 
Planning and Community Right-to-Know Act (EPCRA) Hazardous Chemical 
Inventory Reporting Requirements.'' Available on-line: https://
www.epa.gov/epcra/epcra-sections-311-312.
---------------------------------------------------------------------------
    EPCRA certainly improved industry transparency with regard to the 
production and release of hazardous chemicals, and it represents a step 
forward for emergency planning and response. Its contributions to 
improving actual emergency operations, however, have been constrained 
by a lack of resources on the part of LEPCs, limited capacity among 
fire departments to assimilate and act on chemical information, an 
outdated informational architecture and uneven enforcement by EPA.\6\
---------------------------------------------------------------------------
    \6\ Purifoy DM, EPCRA: A Retrospective on the Environmental Right-
to-Know Act. Available on-line: https://www.ncbi.nlm.nih.gov/pubmed/
2434082.
---------------------------------------------------------------------------
    EPCRA's reliance on LEPCs is particularly problematic because the 
LEPCs are voluntary entities that in the great majority of cases simply 
do not have the capacity to receive and organize complex industrial 
chemical information and update and distribute emergency planning 
documents. I witnessed this when I served on the State Emergency 
Response Commission (SERC) in California, where I heard reports from 
the volunteer LEPC representatives and heard their complaints about the 
objectives they were expected to meet--without the resources necessary 
for doing so.
    For fire departments, raw chemical information is of limited 
utility. Fire departments are not well-suited to organizing, 
assimilating, and acting on raw chemical hazard information provided by 
facilities. To be useful, chemical information from facilities--at a 
minimum--needs to be curated and formatted, and tied to facility-
specific information, as noted above.
            The CFATS emergency planning and response provisions could 
                    be significantly improved.
    The U.S. Chemical Safety and Hazard Investigation Board (CSB) 
identified emergency response deficiencies as a contributor to at least 
14 major industrial chemical incidents. Most of the deficiencies 
occurred in the following areas:
   Training for emergency responders, including hazardous 
        materials training;
   Emergency planning and community response plans and teams;
   Use of community notification systems;
   Use of an incident command system and the National Incident 
        Management System;
   Conducting emergency response exercises;
   Sharing of information among facilities, emergency 
        responders, and the community; and
   Communicating during emergencies.\7\
---------------------------------------------------------------------------
    \7\ U.S. CSB, Drivers of Critical Chemical Safety Change: Emergency 
Planning and Response (Preparedness). Available on-line: https://
www.csb.gov/recommendations/emergency-response-/.
---------------------------------------------------------------------------
    Based on these findings, CFATS could improve its emergency planning 
and response provisions by requiring facilities to:
   Transmit specific types of chemical and facility information 
        to fire departments and other public response agencies;
   Conduct regular planning meetings and training exercises 
        with fire departments and other agencies;
   Conduct an assessment to understand the capacity of fire 
        departments and other agencies to respond effectively to a 
        major chemical incident; and
   Implement corrective actions to address gaps identified in 
        the assessment.
    These requirements would provide a foundation for improving the 
capacity of local fire departments and other agencies to respond 
effectively to a major chemical incident, intentional or otherwise.
    Alongside these improvements in CFATS, we believe there is a need 
for a comprehensive, National emergency response capacity study to 
identify at-risk communities and develop realistic response plans. Many 
communities--particularly those served by volunteer fire departments--
have very limited capacity to respond to a major industrial chemical 
incident.
Objective No. 2: Provide for meaningful worker participation in 
        security planning and decision making
    CFATS section 2102(b)(2) on Employee Input requires that, ``to the 
greatest extent practicable, a facility's security vulnerability 
assessment and site security plan shall include input from at least one 
facility employee and, where applicable, one employee representative 
from the bargaining agent at that facility, each of whom possesses, in 
the determination of the facility's security officer, relevant 
knowledge, experience, training, or education as pertains to matters of 
site security.''
    This is an important aspect of CFATS, and it could be made more 
effective by including a more complete set of employee rights to 
participate in security decision making, modeled California's 2017 
process safety management (PSM) regulations for petroleum refineries, 
as follows:\8\
---------------------------------------------------------------------------
    \8\ California Occupational Safety and Health Standards Board, 
California Code of Regulations (CCR) Title 8, General Industry Safety 
Orders (GISO)  5189.1, Process Safety Management for Petroleum 
Refineries. 2017. Available on-line: https://www.dir.ca.gov/title8/
5189_1.html. A description of the purpose and necessity for each PSM 
element is provided in DIR's Initial Statement of Reasons. Available 
on-line: http://www.dir.ca.gov/OSHSB/documents/Process-Safety-
Management-for-Petroleum-Refineriess-ISOR.pdf.
---------------------------------------------------------------------------
   The right of employees to participate ``throughout all 
        phases'' of CFATS decision making, from design to 
        implementation, training, evaluation, and maintenance;
   The right of employees to select their representatives who 
        participate in management's CFATS decision-making processes;
   Access by employees to information relevant to CFATS 
        decision making, including information that might be subject to 
        protection as a trade secret;
   The right of employees to anonymously report site security 
        weaknesses; and
   The obligation of employers to maintain a record of all 
        employee reports of site security weaknesses.
            Industry recognizes that employees can play an important 
                    role in improving industrial safety; this role 
                    would apply equally to industrial security.
    In its Guidelines for Risk-Based Process Safety, the process 
industry's Center for Chemical Process Safety (CCPS) lists ``workforce 
involvement'' as one of 20 management systems necessary to reduce 
process safety risks and prevent chemical accidents, pointing out 
that:\9\
---------------------------------------------------------------------------
    \9\ Center for Chemical Process Safety (CCPS) and American 
Institute of Chemical Engineers, Guidelines for Risk-Based Process 
Safety. Wiley and Sons. (p. 124). 2007.

`` . . . workers are potentially the most knowledgeable people with 
respect to the day-to-day details of operating the process and 
maintaining the equipment and facilities, and may be the sole source 
for some types of knowledge gained through their unique experiences. 
Workforce involvement provides management a formalized mechanism for 
---------------------------------------------------------------------------
tapping into this valuable expertise.''

    The CCPS defines ``workforce involvement'' as a ``system for 
enabling the active participation of company and contractor workers in 
the design, development, implementation, and continuous improvement of 
the Risk-Based Process Safety management system.''\10\ This same 
definition could be applied to the role of employees under CFATS.
---------------------------------------------------------------------------
    \10\ Ibid. (p. 124).
---------------------------------------------------------------------------
    The CCPS Guidelines were developed and reviewed by experts from 
many of the Nation's leading chemical process companies, including Dow, 
DuPont, ExxonMobil, Chevron Energy Technology Company, 3M, Air Product 
and Chemicals Inc., Shell Chemical, BP, Olin Corporation, Bayer 
Material Science, and others.\11\
---------------------------------------------------------------------------
    \11\ Ibid.. (Preface).
---------------------------------------------------------------------------
            The evidence suggests that the 2012 Richmond, California, 
                    Chevron refinery fire might have been prevented if 
                    managers had involved employee representatives in 
                    decision making.
    Evidence identified by the CSB points to a lack of employee 
participation in process safety decision making as a key factor leading 
up to the 2102 Richmond, California, Chevron refinery fire, which 
endangered the lives of 19 workers and caused some 15,000 area 
residents to seek medical attention for symptoms related to exposure to 
smoke and fire gasses.
    The CSB's interim report of that incident shows that the 
catastrophic pipe failure in the plant's crude unit would have been 
prevented if Chevron's managers had followed the recommendations of 
their own engineers. The fact that they did not resulted in part 
because Chevron employee representatives were excluded from 
management's decision-making process.
    Over a period of several years leading up to the pipe failure and 
fire, the CSB found that Chevron's engineers issued at least 6 reports 
calling attention to the problem of sulfidation corrosion in the crude 
unit and recommending a more aggressive pipe inspection and monitoring 
program. As the CSB pointed out, Chevron's engineers made these 
recommendations against a backdrop of serious sulfidation corrosion 
incidents in the U.S. refinery sector, including at:
   Chevron's El Paso, Texas refinery (1988);
   Chevron's Pascagoula, Mississippi refinery (1988 and 1993);
   Chevron's Salt Lake City, Utah refinery (2002);
   Chevron's Richmond refinery (2007);
   The Silver Eagle refinery in Woods Cross, Utah (2009);
   The Regina Saskatchewan, Canada refinery (2011); and
   The BP Cherry Point, Washington refinery (2012).\12\
---------------------------------------------------------------------------
    \12\ U.S. CSB, Interim Investigation Report. Chevron Richmond 
Refinery Fire of August 6, 2012. (pp. 24-27). Available on-line: 
https://www.csb.gov/chevron-refinery-fire/.
---------------------------------------------------------------------------
    By 2009, Chevron's engineers warned of the potential for a 
catastrophic pipe failure, and still management chose not to act. The 
pipe finally failed in August 2012 in the area the engineers predicted 
it would, and 19 workers nearly lost their lives.
    Had Chevron been required to involve employee representatives in 
management's pipe corrosion assessments, those representatives would 
likely have been aware of the engineers' reports, and they would almost 
certainly have requested that the engineers' recommendations be 
implemented. In taking those actions, the serious state of corrosion in 
the crude unit would have become apparent. This would likely have 
resulted in a shut down of the unit to replace damaged sections of 
pipe, thereby preventing the vapor cloud explosion that ultimately 
occurred in August 2012.
    The same conditions would apply in the security context under 
CFATS. Employees possess unique knowledge and experience that can be 
crucial to ensuring an effective chemical security program.
            The perspectives of rank-and-file employees are invaluable 
                    in site security decision making, but only if they 
                    are given the right to meaningfully participate.
    The requirement for employee input is critical to the success of 
CFATS. Experienced employees often have a deep understanding of the 
practical workings of a plant, and they can apply this experience in 
setting priorities and determining if a proposed security measure will 
function as intended. Employees have a direct stake in protecting the 
safety of the facility. As the CSB identified in the Richmond, 
California, Chevron fire, effective employee participation can improve 
the transparency and accountability of management decision making, 
which can otherwise be skewed by production and financial pressures.
    In practice, however, employees and their representatives will not 
normally be invited to participate with any real authority in 
management's decision-making committees, including those focused on 
plant security. At a minimum--including with a unionized workforce--
employees need regulatory authority to obtain a seat at the table. For 
employee participation to be meaningful, however, that authority must 
provide much more than the basic right to participate; it must provide 
for the following 7 elements:
   Allow employees to select their representatives, either 
        through their collective bargaining agent, where present, or by 
        a credible process established by the employer;
   Ensure employee participation throughout all phases of site 
        security decision making, not simply as a final ``rubber 
        stamp'' to management's proposals;
   Provide for on-going participation in the implementation and 
        maintenance of security measures;
   Provide for participation in the training and evaluation of 
        site security measures;
   Provide a means for anonymous reporting of site security 
        problems, and an obligation of owners or operators to maintain 
        a record of such reports;
   Provide a means for confidential input by employees to 
        regulators during CFATS audits and inspections; and
   Provide a means to document the extent to which employee 
        input has been received and integrated into plant security 
        measures.
    The 2017 California PSM regulations include employee participation 
rights that require the first 5 of the elements noted above, while also 
providing for the right of employees to refuse unsafe work, request 
that a process be shut down, and--for operators--actually shut down a 
refinery process.
Objective No. 3: Implement risk reduction measures to limit the 
        attractiveness of chemical facilities as targets of opportunity
    CFATS is a risk management--rather than risk reduction--framework; 
that is, it assumes that industrial chemical hazards cannot be reduced 
or eliminated, and that those hazards must therefore be ``surrounded'' 
by layers of security in order to reduce the risk of a major release 
initiated by a motivated actor.
    There is evidence, however, that CFATS is motivating some companies 
to voluntarily implement risk reduction strategies. DHS reports that 
thousands of high-risk facilities have chosen to meet their chemical 
security obligations not only through traditional security measures, 
but also by risk reduction strategies that include:
   Consolidating chemicals from multiple sites into one or two 
        sites;
   Replacing a hazardous chemical with a less hazardous one;
   Reducing the total quantity of a chemical held on-site; or
   Switching to a less concentrated form of the chemical.\13\
---------------------------------------------------------------------------
    \13\ Suzanne E. Spaulding, DHS Under Secretary, Correspondence to 
the Honorable Bennie G. Thompson, Ranking Member, Committee on Homeland 
Security. January 11, 2017. See Addendum at page 6, item 12.
---------------------------------------------------------------------------
    Assuming DHS is confident in the veracity of these claims--and is 
taking steps to validate them--these approaches represent progress 
toward reducing industrial chemical risks at CFATS-regulated 
facilities.
    CFATS could do more to improve industrial resilience against a 
motivated actor by further encouraging or requiring facilities to 
investigate--and implement to the extent feasible--approaches such as 
these, which minimize, substitute, moderate, or simplify the chemicals 
and/or processes they have on-site.
    This approach is recommended by the industry's Center for Chemical 
Process Safety (CCPS) of the American Institute of Chemical Engineers 
(AIChE) in the context of process safety, but it is equally applicable 
in the security context:\14\
---------------------------------------------------------------------------
    \14\ CCPS and American Institute of Chemical Engineers, Inherently 
Safer Chemical Processes: A Life Cycle Approach, Second Edition. 2009. 
Wiley and Sons. (p. 27).
---------------------------------------------------------------------------
   To minimize a hazard, the facility could use smaller 
        quantities of a hazardous chemical.
   To substitute a hazard, the facility could replace a 
        hazardous chemical with a less toxic or less flammable one, or 
        it could use a less concentrated form of the chemical.
   To moderate a process, the facility could operate a process 
        under less hazardous conditions, such as by running a process 
        closer to ambient temperature and pressure.
   To simplify a process, the facility could introduce design 
        changes to eliminate unnecessary complexity, and to make 
        operating errors less likely, as well as more forgiving if 
        errors do occur.
    By reducing the hazard severity of chemicals and/or processes used 
at a facility, these measures can limit the attractiveness of the 
facility as a target of opportunity. This approach was developed by 
many of the Nation's leading process companies, including Dow, DuPont, 
Eli Lilly, Rohm and Haas, Honeywell, Braskem, Shering Plough, and Nova, 
and they were peer-reviewed by process safety experts from academia, 
industry, and Government.\15\
---------------------------------------------------------------------------
    \15\ Ibid. (Preface)
---------------------------------------------------------------------------
    California's 2017 PSM regulations for petroleum refineries could 
serve as a model for implementing risk reduction provisions into 
CFATS.\16\
---------------------------------------------------------------------------
    \16\ California Occupational Safety and Health Standards Board, 
California Code of Regulations (CCR) Title 8, General Industry Safety 
Orders (GISO)  5189.1, Process Safety Management for Petroleum 
Refineries. 2009. Available on-line: https://www.dir.ca.gov/title8/
5189_1.html.
---------------------------------------------------------------------------
           v. congress should take action to strengthen cfats
    It is essential that Congress take action to protect workers, 
communities, and the Nation's industrial infrastructure from the threat 
of an intentional attack. The findings of the GAO illustrate that the 
CFATS program is making progress in meeting this objective, and that 
more can and must be done. The BlueGreen Alliance recommends that 
Congress improve the effectiveness of CFATS by making revisions that 
will motivate and require companies to meet three critical objectives:
   Ensure a safe, effective emergency response to a major 
        industrial chemical incident;
   Provide for meaningful worker participation in security 
        planning and decision making; and
   Implement risk reduction measures to limit the 
        attractiveness of chemical facilities as targets of 
        opportunity.
    The historical record and the findings of the CSB illustrate that a 
major industrial chemical release, fire, or explosion caused by a 
motivated actor could devastate the lives of workers, families, and 
entire communities. We urge you to use the reauthorization of CFATS as 
an opportunity to strengthen the program. The result will be improved 
security for our Nation's process facilities, safer workplaces and 
communities, and a more resilient industrial infrastructure.
    Chairman Richmond, Ranking Member Katko, and distinguished Members, 
thank you again for granting me the opportunity to appear at today's 
hearing.

    Mr. Richmond. Thank you.
    I now recognize Mr. Morawetz to summarize his statement for 
5 minutes.

       STATEMENT OF JOHN S. MORAWETZ, HEALTH AND SAFETY 
  REPRESENTATIVE, INTERNATIONAL CHEMICAL WORKERS UNION COUNCIL

    Mr. Morawetz. Thank you, Chairman Richmond, Ranking Member 
Katko, and subcommittee Members for the honor of appearing 
before you to talk about the safety of our chemical facility 
members and facility security.
    My name is John Morawetz and I am here today representing 
the International Chemical Workers Union Council, which is a 
council of the United Food and Commercial Workers Union. The 
ICWUC was founded in 1944 and represents 20,000 chemical 
workers in 32 States.
    The million-member UFCW strongly supports a multi-year 
authorization of CFATS with certain essential improvements. The 
industries we work in include petroleum and coal products, 
pharmaceuticals, agricultural chemicals, natural gas 
distribution, nuclear weapons and power plants.
    We work with extremely hazardous substances and have a 
vested interest in the safe operation of their facilities for 
all workers' health and their facilities' and communities' 
well-being.
    We handle many of the CFATS Appendix A hazardous materials 
in railcars, storage tanks, reactor vessels and respond as part 
of on-site response teams. Thankfully, there has not been a 
terrorist attack on a chemical facility, but much can be 
learned from an unintentional releases at facilities we 
represent.
    In 2014, 4 people died from a massive release of methyl 
mercaptan in Houston, Texas and in 2016 there was a complete 
rupture of a full chlorine tanker care in West Virginia that 
luckily did not kill anybody.
    Most tragically, in 1971 a Georgia facility that 
manufactured magnesium trip flares had some fires and then blew 
up. Horribly, the evacuation distance was not sufficient and 27 
workers were killed.
    We can and must learn from each event, large or small, or 
from near-misses. We recommend 4 CFATS improvements: Worker 
involvement in security plans, more training for workers and 
inspectors, stronger whistleblower protections, and compilation 
of best practices.
    First and foremost, workers and representatives in labor 
need to be involved in protecting our chemical infrastructure. 
Chemical workers have direct, current knowledge and experience. 
It is invaluable in solving a site-specific problem. It's 
important that workers' expertise, the same expertise that 
operates these plants every day, be utilized in the drafting, 
implementation, and evaluation of plant security plans.
    We recommend that facility operators document and certify 
employee security recommendations and share these with CFATS 
inspectors.
    I would love to tell you about CFATS inspections, but we 
don't know since we are not informed of these visits. Since the 
law allows inspectors the discretion of involving workers or 
not, our locals and members have not been included. Therefore, 
an important stakeholder and their valuable information has 
been excluded from inspections.
    Other Federal agencies, including OSHA, NIOSH, the EPA, and 
the U.S. Chemical Safety Board, have established inspection 
models for working with both management and labor.
    The second key to effective security, worksite security, is 
good training for everyone about their roles and 
responsibilities and drills for proper response, as well as 
training of CFATS inspectors. This is more fully described in 
my written testimony.
    Third, whistleblowers who disclose wrongdoing can save 
lives and help improve public safety and should not face 
retaliation. Regretfully, fear is a fact of life in all too 
many workplaces and jeopardizing one's job by blowing the 
whistle can be risky.
    We recommend that OSHA, which currently administers 
whistleblower complaints for 22 Federal agencies, handles CFATS 
complaints.
    Last, facilities that have successfully reduced their risk 
have valuable best-practice information that should be 
aggregated and annually released. DHS has stated that many, 
``CFATS facilities have either reduced their holdings of high-
risk chemicals of interest or eliminated them completely, 
substituting less risky chemicals or have changed their 
processes and have actually come out of the program.''
    We believe facilities have much to learn from each other 
and best practices such as safer substances, reductions in 
storage and--use are some of them.
    I applaud the recognition that the measures you are 
discussing will help protect us, not only from a terrorist 
attack but also hazardous material releases from a natural 
disaster or accident. The changes outlined in my testimony will 
fulfill CFATS' mandate and mitigate the consequences and risk 
of a release, regardless of the cause.
    We support the work of this subcommittee to ensure the 
safety of our chemical workers, their communities, and all 
Americans through a multi-year CFATS reauthorization. This will 
reduce risk and protect workers and communities from a 
terrorist attack and other tragedies.
    Thank you, and I will take questions later.
    [The prepared statement of Mr. Morawetz follows:]
                 Prepared Statement of John S. Morawetz
                             March 12, 2019
    Thank you, Chairman Richmond, Ranking Member Katko, and Members of 
the subcommittee for holding this important hearing and for the 
opportunity to testify. I am here today representing the International 
Chemical Workers Union Council (ICWUC) of the United Food and 
Commercial Workers International Union (UFCW). The ICWUC was founded in 
1944 and represents approximately 20,000 chemical workers in 32 States. 
In 1996, we merged with the UFCW and this mutually-beneficial 
partnership continues to serve our members well today. It is my honor 
to appear before you to address the safety and health of our members 
who work in chemical plants and the security of these facilities.
    ICWUC strongly supports a multi-year authorization of the Chemical 
Facilities Anti-Terrorism Standards (CFATS) program with certain 
essential changes.
         about the international chemical workers union council
    The ICWUC has been active for decades in promoting strong and 
effective health and safety standards in hazardous chemical facilities 
where our members work. Workers and their union representatives have a 
vested interested in safe worksites. The ICWUC supports chemical safety 
standards and laws to protect both our members, the facilities they 
work at, and the public.
    UFCW chemical workers work in many different manufacturing 
industries including petroleum and coal products, fertilizers, 
pharmaceuticals, pesticides, and other agricultural chemicals in 
smelters and refineries, as well as, natural gas distribution, nuclear 
weapon production, and power plants. Our members work with extremely 
hazardous substances and have a vested interest in the safe operation 
of their facilities for their own health, for their coworkers' health 
and for their communities' well-being.
    Our members handle many of the hazardous materials in CFATS 
Appendix A. Specifically, we unload tankers and railcars that contain 
hazardous materials, monitor large storage tanks filled with these 
substances, move the storage tanks within our facilities, manage the 
control rooms that monitor and operate reactor vessels, and load the 
containers for their shipment offsite. The vast majority of the time, 
the handling of chemicals is done safely, but when there is a release, 
we respond in a range of roles including on-site response teams. 
Thankfully there has not been a terrorist attack on a chemical facility 
to date, but there is much that can be learned from unintentional 
incidents. Examples of the tragic impact of the release of Appendix A 
hazardous materials include an incident in 2014, where 4 people were 
overcome by the massive release of methyl mercaptan in Houston, Texas 
or the rupture of a full chlorine tanker car in West Virginia that 
luckily did not kill anyone.\1\ Chemical safety is a very serious issue 
that we are familiar with and the workers at chemical facilities want 
to do everything possible to prevent these types of events whether from 
terrorism or other causes.
---------------------------------------------------------------------------
    \1\ https://www.ntsb.gov/investigations/AccidentReports/Reports/
HZM1901.pdf.
---------------------------------------------------------------------------
    Past incidents remind us of the danger that these chemicals pose. 
The site of one of ICWUC's most tragic loss of lives was in 1971 at the 
Thiokol facility near Woodbine, Georgia, which manufactured magnesium 
trip flares for the U.S. Army during the Vietnam War. On February 3, 
1971, the Thiokol facility was evacuated after several small fires 
broke out inside the plant which caused the flares to ignite and the 
plant was destroyed. Horribly, the evacuation distance was not 
sufficient, and 27 workers were killed when the plant blew up. The 
Thiokol explosion led to a better understanding of the full danger of 
the materials in that plant and what a safe evacuation distance should 
be.
    Unions have a proud history of fighting for the right to a safe 
workplace and for the basic right for workers to return home after a 
day on the job as healthy as when they left. Unions have made sure 
their members are educated and trained on the safety and health hazards 
they face on the job. Union negotiators bargain over health and safety 
contract language, unions actively participate in the investigation and 
identification of health and safety hazards, and testify in support of 
legislation which strengthens workplace safety and health. We are 
actively involved in making our workplaces safer. It is therefore an 
honor for me to appear before you to address the safety and health of 
our members who work in chemical plants and the security of these 
facilities.
    As to my background, I have over 3 decades of experience 
investigating occupational health hazards for the National Institute 
for Occupational Safety and Health (NIOSH); as the director of health 
and safety for the Molders Union and here at the Chemical Workers Union 
as the director of health and safety and currently the director of the 
Training Center in Cincinnati, Ohio. I am testifying today in my 
capacity as a representative of the ICWUC Health and Safety Department.
    In my testimony, I will address the following elements that are 
crucial to the safety of chemical plants:
    (1) worker involvement in security plans,
    (2) effective training requirements,
    (3) strong whistleblower protections, and
    (4) successful practices.
                              about cfats
    In 2007, the Department of Homeland Security (DHS) established the 
CFATS program to identify and assess the security risk posed by 
facilities that contain hazardous chemicals that could be used by 
terrorists to inflict mass casualties or harm surrounding populations. 
DHS approves facility security plans and inspects high-risk facilities 
to ensure that the facilities are compliant with required security 
measures and procedures.
          workers must be involved in chemical plant security
    CFATS inspectors, workers, labor representatives and company 
representatives all need to be involved in protecting our chemical 
infrastructure. Chemical workers have direct, current knowledge and 
experience of plant operations that is invaluable in solving site-
specific problems. Chemical workers know first-hand how a plant works, 
what chemicals are used, how those chemicals react to one another and 
their facilities' weaknesses. We also know if back-up systems will work 
when the power goes out. We know the exact location of the CFATS 
hazardous materials and we know if training is effective. All these 
responsibilities make chemical workers the first and best line of 
defense.
    We believe employee involvement in the drafting, implementation, 
and evaluation of plants' chemical security plans is crucial. It is 
important that workers' expertise--the same expertise that operates 
these plants everyday--be utilized. Including chemical workers in this 
process will enhance facility security and protection. We believe the 
facility's operator should document recommendations received from 
employees in their site security plans, certify that there has been 
worker input into the site security plan, and share employee 
recommendations with inspectors.
    Workers should be involved in chemical facility security because 
our on-site responders are the first people to respond to catastrophic 
events. At many sites, there is a joint labor management response team 
that is usually the first on the scene to an incident. The experiences 
and knowledge of workers is important when considering how to prevent 
or plan for future incidents. These workers should be talking with 
CFATS inspectors and sharing their knowledge along with management.
    Workers should also be protected from any type of retaliation on 
the part of employers for full involvement in workplace safety and 
health, and chemical plant security efforts. Any barriers to 
involvement, such as discipline for reporting incidents or talking with 
CFATS inspectors should be identified and removed.
    I'd love to tell you about our perspective of what takes place 
during a CFATS inspection, but we don't know since we are not informed 
of these visits. Right now, the law allows discretion on the part of 
inspectors as to whether workers and the union are advised of an 
inspection. We currently have no information that our locals or members 
have been involved in inspections, and this means an important 
stakeholder and their valuable information may be excluded from the 
process.
    Concerns about interfering in the labor management relationship 
should not be a barrier to greater chemical plant safety. Federal 
agencies including the Occupational Safety and Health Administration 
(OSHA), NIOSH, the U.S. Chemical Safety Board and the Environmental 
Protection Agency (EPA) all have procedures to work with both 
management and labor during their inspections. By not involving labor 
in these inspections, they are relying on management's information and 
have de-facto taken a side.
    Workers need to know their basic CFATS rights. One way to inform 
and include workers is to require a CFATS breakroom poster in all 
chemical facilities that submitted a Top Screen survey. The poster 
could include basic facts about CFATS and contact information like OSHA 
breakroom posters.
  effective training for all workers at covered areas in cfats-tiered 
                               facilities
    Key to effective worksite security is good training for everyone 
about their roles and responsibilities and drills for proper response 
and evacuation. For over 30 years my union has run training programs 
and collected data on how much training our members received in the 
previous 12 months in 10 specific areas. OSHA's Hazard Communication 
Standard is the primary OSHA standard requiring training on hazardous 
chemicals, and the requirement is minimal--only when initially assigned 
to a job, or if new chemicals are introduced. Other than this initial 
training, workers often do not receive further training on hazardous 
chemicals. According to data collected by our union, we found that from 
2017 to 2018 over 80 percent of workers who attended ICWUC training had 
no training in the last year in 9 of the 10 key worker safety areas. 
The 9 areas not trained on were: Engineering Controls, Air Monitoring, 
Decontamination, Toxic Effects, Emergency Response Procedures, OSHA 
Regulations, Plugging and Patching, Selection of Protective Clothing or 
Respirators. The Government and companies must increase the amount and 
type of training for all workers inside of CFATS-covered plants.
    Effective training requires training materials that are easily 
understood, and that are targeted to the audience using the materials. 
An example of where materials have been developed that are useable and 
understandable, is the State of New Jersey which has taken a strong 
interest in the security of their chemical plants. The State has 
devoted a considerable amount of time and effort over the last 30 years 
to developing clear resources on these key issues. The New Jersey 
training materials cover many of the CFATS substances.
    Implementing good training is not easy. One facility that I 
reviewed was trying to implement the right procedures but after careful 
review, I realized that all the drills were taking place on the first 
shift because that is when the salaried employees worked. The facility 
has three shifts and operates continuously, so only a fraction of the 
workers were being drilled for these types of events.
    Training is also important for the CFATS inspectors. They should be 
trained on toxic effects, chemical operations, CFATS procedures, Top 
Screen operation and definition of tiers, effective controls, 
incompatible substances, relevant guidelines and standards, and methods 
that reduce the potential consequences of a terrorist attack. Their 
training should also include knowledge of methods to reduce or remove 
hazards that could be attractive targets. It would be extremely 
valuable to inspectors to know how similar facilities have reduced or 
removed such hazards. We need to be sure that information received by 
CFATS inspectors is consistent with the best industry practices and 
inspection observations.
   whistleblower protections for workers to report problems to cfats
    In addition to routine interactions with inspectors, employees at 
facilities with hazardous chemicals can play an important role in 
helping to ensure CFATS compliance by submitting a whistleblower report 
when they suspect noncompliance. Whistleblowers who disclose wrongdoing 
at chemical facilities can save lives and help improve public safety 
and health and should not face retaliation.
    Regretfully fear is a fact of life at all too many workplaces and 
jeopardizing one's job by blowing the whistle is a risky thing to do. 
Workers, who bravely come forward to protect themselves, their co-
workers, and communities around the plant, should not fear losing their 
jobs when they speak out. Whistleblower protection is vital in assuring 
the free exchange of ideas, improving security, and ensuring that 
effective measures are actually implemented. Workers must have the 
ability to come forth and communicate program deficiencies without fear 
of retribution.
    DHS is responsible for managing the CFATS whistleblower process and 
procedures, but DHS lacks a process and procedures to address 
whistleblower retaliation reports. OSHA has developed guidance with 
recommended practices for public, private, and non-profit employers to 
use in preventing and addressing whistleblower retaliation. To help 
ensure that whistleblower retaliation reports are addressed efficiently 
and effectively, we recommend that OSHA, which currently administers 
whistleblower complaints from 22 Federal agencies, should administer 
CFATS complaints as well.
       cfats should identify and disseminate successful practices
    There are many steps and measures that could and should be taken to 
improve chemical plant safety and security. The U.S. Department of 
Homeland Security has stated that many ``CFATS facilities have either 
reduced their holdings of high-risk chemicals of interest or eliminated 
them completely, substituting less risky chemicals or have changed 
their processes and have actually come out of the program and 
determined to no longer to be high risk.''\2\ These facilities have 
substituted less dangerous formulations, better designed containers, or 
various engineering steps, which all can minimize the consequences of 
an accident or attack at a chemical plant. Unfortunately, there is no 
report that can be shared with other facilities that spells out the 
methods to reduce the consequences of a catastrophic release of 
chemicals from intentional attacks or unintentional disasters.
---------------------------------------------------------------------------
    \2\ Secretary Wulf's testimony before House Homeland Security 
Committee on February 27, 2019.
---------------------------------------------------------------------------
    Although reducing potential consequences may not be feasible in all 
circumstances, either technologically or economically, safer solvents 
or formulations could be substituted for more dangerous ones. The 
quantities or concentrations can be reduced to below threshold amounts, 
some substances can be used in a less dangerous form, alternative 
processes can be used, chemicals can be used ``just in time'' (without 
storage), vulnerable sections can be reinforced, improving inventory 
control, minimizing bulk storage and maintenance schedules reviewed 
regularly. Many companies have implemented these changes and there is 
much to be learned from which changes have been the most effective. 
This information sharing can be done without identifying individual 
companies or locations.
    Incorporating these considerations into site security planning will 
ensure that covered chemical facilities are aware of the security 
implications of their production processes and enable the selection of 
more effective security methods.
    Facilities that have successfully reduced their risk have valuable 
best practices information that should be aggregated and annually 
released. Facilities have much to learn from each other and aggregated 
data could be one step.
                               conclusion
    Although this committee's mandate is the protection of facilities 
from terrorist attack, I applaud the recognition that the measures that 
you are discussing will protect us not only from a terrorist attack but 
will also minimize a hazardous materials release resulting from a 
natural disaster or accident. The dangers we face in a chemical release 
come from a variety of directions, but the changes outlined in my 
testimony will mitigate the consequences and risks of a release 
regardless of the cause of that release and fulfill CFATS' mandate.
    The International Chemical Workers Union Council supports the work 
of this subcommittee to ensure the safety of our chemical workers, the 
communities around the facilities and all Americans. We strongly 
support a multi-year reauthorization of the Chemical Facilities Anti-
Terrorism Standards program, hope this authorization will reduce risk, 
protect workers and communities, prevent a terrorist attack and 
tragedies like the Thiokol explosion in 1971.
    On behalf of the ICWUC, I urge you to act now to protect America--
to protect all workers and their families--by strengthening and 
reauthorizing CFATS before it expires next year.
    Again, I thank you for your time and would be pleased to answer any 
questions that you may have.

    Mr. Richmond. Thank you, Mr. Morawetz. I now recognize Ms. 
Nixon for 5 minutes.

 STATEMENT OF PAMELA NIXON, PRESIDENT, PEOPLE CONCERNED ABOUT 
                        CHEMICAL SAFETY

    Ms. Nixon. Good morning. Thank you for allowing me the 
opportunity to provide a community perspective for improving 
CFATS. I am representing People Concerned About Chemical 
Safety, also known as PCACS. We are located in the center of 
Appalachia in Charleston, West Virginia in the Kanawha Valley.
    We are dedicated to protect the health and safety of those 
who reside, work, and study in the vicinity of local facilities 
that produce highly toxic chemicals.
    The core of our work is to promote environmental and social 
justice principles and encourage the inclusion of all peoples 
that are disproportionately impacted by decision makers. PCACS 
is also affiliated with Environmental Justice Health Alliance 
for Chemical Policy Reform.
    For decades it has been proven that in study after study 
that low-income communities and communities of color are 
disproportionately impacted by hazardous waste facilities and 
facilities that emit highly toxic and extremely hazardous 
chemicals.
    In Kanawha County there is a community called Institute. 
It's mostly an African-American community of about 800 
households and it's also the home for a--an historically black 
university, West Virginia State University, which is on 
direct--directly on the fence line of one of the hazardous 
high-risk facilities in the Kanawha County.
    Seventy--approximately 70 percent of the people in Kanawha 
County live in a 3-mile radius of one or more high-risk 
facilities that are included in the EPA Risk Management Plan 
Program.
    We have experienced chemical fires, explosions, worker 
deaths, and numerous air releases forcing us to shelter in 
place. These incidences were not acts of terrorism and many of 
them occurred in the Institute area.
    Making a chemical facility harder for terrorists to attack 
and adding cybersecurity doesn't fundamentally change the 
probability of a major chemical incident that can cause off-
site consequences.
    PCACS has met over the years with chemical company 
officials asking them to reduce their hazardous chemical 
inventory, to replace the highly toxic, extremely hazardous 
compounds with less dangerous chemicals when possible, to 
switch to safer processes when feasible, and to adopt best 
practices identified by employees and process safety experts.
    It is important--it was only after the 2008 explosion at 
the Bayer Crop Science Facility in Institute and findings from 
the Chemical Safety Board and the National Research Council 
that some of the chemical plants in Kanawha County began steps 
to reduce their risks to the community.
    It is important that CFATS coordinates with other 
Government agencies to reduce these facilities as target risks.
    West Virginia is a rural State and many of our fire 
departments are run by volunteers and with very little funding. 
It's imperative that CFATS and high-risk facilities share 
information with first responders and especially with volunteer 
fire departments to ensure that they are properly trained, 
understand the characteristics of the hazardous chemicals, and 
have the proper protective equipment. Proper training and 
current information on these chemicals allow first responders 
to return home safely.
    According to our Kanawha Putnam Emergency Planning 
Committee Terrorist Incident Response Section, Kanawha and 
Putnam County metro area are vulnerable to terrorist incidents.
    We have 4 clusters of high-risk chemical facilities located 
along the valley floor. Four. These are all reasons why 
communities like mine and others in E.J. need to be protected--
in EJHA need to be protected by policy language that addresses 
cumulative impacts. Our communities cannot afford to have 
anything less.
    We encourage improvements in CFATS to include coordinating 
with other Government agencies to ensure that high-risk 
facilities reduce their risk, ensuring that the facilities 
provide the current information to the first responders, 
sharing information as much as possible without compromising 
security to address public concerns in order to improve 
confidence in CFATS.
    We need CFATS to recognize and account for cumulative 
impacts, including the presence of more than one facility near 
a community. Respecting the critical importance of the 
community to assess the information--to access information on 
hazards of--that--on hazards ensuring that the community have 
access to the information. We need to be informed as partners 
in security.
    Assessing how facilities that have tiered out--that have 
tiered out of the program and to share this information and 
practices with other facilities and to work with covered 
facilities to help them to be proactive in assessing whether 
they should reduce or eliminate their chemical vulnerabilities.
    Thank you.
    [The prepared statement of Ms. Nixon follows:]
                   Prepared Statement of Pamela Nixon
                             March 12, 2019
    Good morning, my name is Pamela Nixon. Thank you for allowing me 
the opportunity to provide a community perspective for improving the 
Chemical Facility Anti-Terrorism Standards (CFATS) program of the 
Department of Homeland Security (DHS).
    I am representing People Concerned About Chemical Safety (PCACS), 
located in the center of Appalachia in Charleston, WV, in the Kanawha 
Valley.
    PCACS, formerly known as People Concerned about MIC, has been 
active in community for over 30 years. It was formed after we learned 
that methyl isocyanate (MIC) was being produced in Institute, WV. MIC 
is the same chemical that killed and injured thousands in the Bhopal, 
India, in 1984.
    We are dedicated to protect the health and safety of all who 
reside, work, and study in the vicinity of local facilities that 
produce highly toxic chemicals. The core of our work is to promote 
environmental and social justice principles that encourage the 
inclusion of people disproportionately impacted by decision makers.\1\
---------------------------------------------------------------------------
    \1\ People Concerned about Chemical Safety website: http://
peopleconcernedaboutmic.com/.
---------------------------------------------------------------------------
    PCACS is affiliated with the Environmental Justice Health Alliance 
for Chemical Policy Reform (EJHA), which networks grassroots 
organizations throughout the country to build collective intelligence 
and advocate for chemical policy reforms that protect environmental 
justice communities.\2\
---------------------------------------------------------------------------
    \2\ Environmental Justice Health Alliance for Chemical Policy 
Reform website: https://ej4all.org/about-us/overview.
---------------------------------------------------------------------------
    For decades it has been proven in study after study that low-income 
communities and communities of color are disproportionately impacted by 
hazardous waste facilities, facilities that emit highly toxic and 
extremely hazardous chemicals being located nearby.\3\ \4\ These 
communities are the most vulnerable and when there is a disaster, they 
have the least ability to recover financially, physically, and 
mentally.
---------------------------------------------------------------------------
    \3\ Toxic Wastes And Race In The United States. United Church of 
Christ. 1987. https://www.nrc.gov/docs/ML1310/ML13109A339.pdf.
    \4\ Who's In Danger? Race, Poverty, and Chemical Disasters. 
Environmental Justice and Health Alliance for Chemical Policy Reform. 
May 2014. https://comingcleaninc.org/assets/media/images/Reports/
Who%27s%20in%20Danger%20Report%20FINAL.pdf.
---------------------------------------------------------------------------
    The community of Institute is mostly an African American 
unincorporated community, and is home to West Virginia State 
University, a Historically Black College and University (HBCU) which is 
directly at the fence line of a high-risk facility. The majority of the 
chemical incidents that have occurred in the Kanawha Valley, occurred 
in Institute. The residential community and approximately 4,000 
students, staff, and faculty on campus have always had to shelter in 
place because the 2-lane road is not be capable to evacuate them out in 
a timely manner. In the eastern part of Kanawha County the community of 
Belle would have a similar issue evacuating from around the facility 
located there.
    Seventy percent of people in the Charleston area live within a 3-
mile radius of one or more high-risk chemical plants.\5\ We have 
experienced chemical fires, explosions, worker deaths, and numerous air 
releases forcing us to shelter in place. And these incidents were not 
acts of terrorism.
---------------------------------------------------------------------------
    \5\ Life At The Fenceline: Understanding Cumulative Health Hazards 
in Environmental Justice Communities. Sept 2018. Environmental Justice 
Health Alliance For Chemical Policy Reform/Coming Clean/Campaign For 
Healthier Solutions. https://new.comingcleaninc.org/assets/media/
documents/Life%20at%20the%20Fenceline%20%20English%20%20Public.pdf.
---------------------------------------------------------------------------
    Making a chemical facility harder for terrorists to attack and 
adding cybersecurity, doesn't change the probability of a major 
chemical incident that can have off-site consequences. Over the decades 
PCACS met with company officials and requested that they assess their 
vulnerabilities in order to lower their risk as a target. We wanted 
them to reduce their inventory, to install inherently safer 
technologies, to substitute the highly toxic/extremely hazardous 
compounds with less dangerous chemicals, and to involve the workforce 
with engineers for insight on simplifying the process to less complex 
procedures that would minimize the human error factor. It was only 
after the 2008 explosion at the Bayer CropScience plant in Institute, 
and the findings from the investigations of the U.S. Chemical Safety 
and Hazard Investigation Board (CSB), and National Research Council of 
the National Academies that some companies in Kanawha began to take 
steps to reduce risks at their facilities.\6\ \7\
---------------------------------------------------------------------------
    \6\ CSB Final Report: Bayer CropScience. https://www.csb.gov/bayer-
cropscience-pesticide-waste-tank-explosion/
    \7\ The Use and Storage of Methyl Isocyanate (MIC) at Bayer 
CropScience. National Research Council of the National Academies. 2012. 
https://www.nap.edu/catalog/13385/the-use-and-storage-of-methyl-
isocyanate-mic-at-bayer-cropscience.
---------------------------------------------------------------------------
    It is important that CFATS coordinates with other governmental 
agencies to reduce the facilities risks as a target. West Virginia is a 
rural State and many of our fire departments are run by volunteers with 
very little funding. It is imperative for CFATS and the high-risk 
facilities to share information with first responders, and especially 
with volunteer fire departments to insure they are properly trained, 
understand characteristics of the hazardous chemicals, and have the 
proper protective equipment. Fortunately, our high-risk chemical 
facilities in the Kanawha Valley have their own in-house responders, 
and they send their nearest first responders to training and provide 
them with some essential protective equipment in case the department is 
needed to provide mutual aid. Proper training and current information 
on the chemicals will allow them to return home safely.
    According to our Kanawha Putnam Emergency Planning Committee 
(KPEPC) Terrorist Incident Response section of the Emergency Management 
Plan, the Kanawha/Putnam Metro area is vulnerable to terrorist 
incidents. We have four clusters of high-risk chemical facilities 
located along the valley floor. If there is a terrorist incident, by 
Federal mandate the FBI is the lead agency for crisis intervention. The 
DHS or FEMA may elect to lead consequence management,\8\ but the lack 
of public information may make it difficult for DHS CFATS to address 
public information.
---------------------------------------------------------------------------
    \8\ Terrorist Incident Response. Kanawha Putnam Emergency 
Management Plan. Revised 4/18/2017. http://www.kpepc.org/shared/
content/Page_objects/ahp_docs/FA_A20_Terrorism.- pdf.
---------------------------------------------------------------------------
    These are all reasons why communities like mine and others in EJHA 
be protected by policy language that addresses cumulative impacts. At 
this point our communities cannot afford to have anything less.
    We encourage improvement of the CFATS program to include:
   Coordinating with other Government agencies to ensure the 
        high-risk facilities reduce their risk at being a target;
   Coordinating with other Government agencies to ensure there 
        are no regulatory conflicts in the laws to prevent security 
        breaches;
   Ensuring high-risk facilities provide the current 
        information on hazardous chemicals to first responders;
   Have information to address public concerns in order to 
        improve confidence in CFATS;
   Recognizing and accounting for cumulative impacts, including 
        the presence of more than one hazardous facility in a 
        community;
   Respecting the critical importance of community access to 
        information on hazards and solutions, ensuring that communities 
        have access to the information they need to be informed 
        partners in security, and ensuring this information does not 
        present the communities any additional exposure (recognizing 
        that much information about these facilities is already 
        available in the public domain);
   Assessing how facilities that have ``tiered out'' of the 
        program did so (i.e. reduced or eliminated their chemical 
        vulnerabilities so that they are no longer required to 
        participate), and sharing those practices or approaches with 
        other facilities in the program; and
   Working with covered facilities to help them pro-actively 
        assess whether they could reduce or eliminate chemical 
        vulnerabilities.
    Thank you for allowing me to speak today.

    Mr. Richmond. Thank you, Ms. Nixon. We will now have Ms. 
Meskill.

  STATEMENT OF KIRSTEN MESKILL, DIRECTOR, CORPORATE SECURITY, 
                              BASF

    Ms. Meskill. Thank you and good morning, Chairman Richmond, 
Ranking Member Katko, and Members of the subcommittee, for the 
opportunity to testify today.
    I am Kirsten Meskill, director of corporate security for 
BASF Corp., a corporation headquartered in Florham Park, New 
Jersey.
    We have over 100 facilities in 30 States and more than 
20,000 employees in North America. I am the immediate past 
chair of the Chemical Sector Coordinating Council, and I am 
currently serving as the Chair for the Security Committee of 
the American Chem Council, ACC.
    I am here today on behalf of the ACC to voice general 
support for a multi-year reauthorization of the Chemical 
Facility Anti-Terrorism Standards, CFATS. ACC member companies 
manufacture products that are critical to the everyday health 
and well-being of our Nation and essential to developing a more 
sustainable and competitive economy.
    Based on our critical role in the Nation's economy and our 
responsibility to employees and the communities where we 
operate, security is a top priority for my company and for the 
ACC.
    In 2001, ACC created a stringent mandatory security program 
called The Responsible Care Security Code. Since its creation 
ACC members have invested more than $17 billion under the 
Security Code to further enhance site security, transportation 
security, and cybersecurity at our facilities. The Security 
Code has become a gold standard for the industry and serves as 
a model for regulatory programs.
    Over the past 4 years the Department of Homeland Security 
has significantly improved its administration of the CFATS 
program and has a--has had a positive impact on enhancing 
security at chemical facilities.
    Most importantly, DHS leadership has demonstrated a 
commitment to working with members of the regulated community 
to improve implementation of the CFATS program.
    While DHS has made considerable strides to improve CFATS, 
there are additional areas for improvement. I would like to 
highlight 4 of these today.
    Ensure multi-year authorization. While industry was pleased 
that Congress passed a short-term extension in January to avoid 
a complete shutdown of CFATS, I think we all agree that it is 
not the best solution going forward. Longer authorization 
periods provide important stability for planning security 
investments and allow DHS to operate the program efficiently 
and effectively.
    Congressional oversight is important to evaluate the 
efficacy of CFATS regarding the changing security environment; 
however, multi-year authorization is warranted to meet the key 
objectives of stability and efficiency of the program overall.
    Second, assess the value of TSDB screening at low-risk 
facilities. Recently DHS has been implementing a risk-based 
performance standard at 200 high-risk facilities, those that 
are at Tiers 1 and 2.
    This requires facility operations--operators to collect 
sensitive personal information from thousands of employees and 
contractors for DHS to vet against a terrorist screening 
database.
    DHS is now planning to extend the program to an additional 
3,000 low-risk Tier 3 and 4 facilities. This will expand 
vetting to tens of thousands of more employees and contractors. 
ACC and its members are concerned that with such an expansion 
it is unnecessary and it will put personal information at risk.
    Furthermore, it is unclear what benefit is associated with 
the additional vetting given the cost. While we support vetting 
at high-risk Tier 1 and 2 facilities, we hope DHS can 
reconsider this requirement for lower-risk 3 and 4 facilities.
    Third, improving transparency in DHS risk determinations. 
This comes by being more transparent with facility operators 
about risk determination, tiering levels, and ways to 
potentially reduce that risk.
    Since the operator is responsible and has authority to make 
security risk-management decisions for the facility it is 
important that they have access to all the information about 
risk-sharing.
    Finally, establish a CFATS public-private partnership. DHS 
should leverage CFATS and industry stewardship programs such as 
ACC Responsible Care Program with the goal of further enhancing 
the security of hazardous chemicals.
    By doing so, DHS would be able to recognize responsible 
operators for going beyond mere regulatory compliance and 
incentivize the use of chemical security programs that enhance 
security beyond the universe of CFATS-regulated facilities.
    I would like to close by saying CFATS has helped make our 
industry and communities more secure. It's a program that will 
grow stronger by adopting some additional improvements while 
ensuring it retains a strict focus on security and continued 
engagement of this community. Thank you.
    [The prepared statement of Ms. Meskill follows:]
                 Prepared Statement of Kirsten Meskill
                             March 12, 2019
    Thank you, Chairman Richmond, Ranking Member Katko, and Members of 
the subcommittee for inviting me to participate in today's hearing. I 
am the director of corporate security for the BASF Corporation. 
Headquartered in Florham Park, New Jersey, BASF operates over 100 
production facilities with a footprint in 30 States and employs more 
than 20,000 people across North America. BASF's largest sites are 
located in Geismar, Louisiana and Freeport, Texas.
    I have also served as the chair of the Chemical Sector Coordinating 
Council and I am current chair of the security committee of the 
American Chemistry Council (ACC), on whose behalf I am testifying 
today. ACC represents a majority of the chemical producers across the 
United States, including a diverse set of small and medium-sized 
companies engaged in the business of chemistry.
    The business of chemistry is a $526 billion enterprise; providing 
more than 500,000 skilled, good-paying American jobs. The chemical 
manufacturing industry is experiencing a renaissance in the United 
States thanks to the increase in domestic shale gas production. In 
fact, ACC has identified more than 330 new capital investment projects 
worth more than $200 billion adding tens of thousands of jobs and 
generating almost $300 billion dollars in economic activity.
    BASF has a responsibility to protect our employees and the 
communities in which we operate, so chemical security remains a top 
priority for us and for all member companies of ACC. In fact, in 2001, 
ACC created a stringent, mandatory security program known as the 
Responsible Care Security Code. Since the Security Code was 
established, ACC members have invested more than $17 billion to further 
enhance site security, transportation security, and cybersecurity at 
all member facilities. The Security Code has become the gold standard 
for the industry and serves as a model for regulatory programs.
    ACC supports a long-term reauthorization of the Chemical Facility 
Anti-Terrorism Standards (CFATS) program. Ensuring that CFATS remains 
in place is a crucial part of establishing a stable regulatory 
environment and providing the needed certainty to foster long-term 
security investments.
                          program improvements
    Over the past few years, the Department of Homeland Security (DHS) 
has significantly improved its administration of the CFATS program; 
having a positive impact on chemical security across the United States. 
Several factors have led to its recent success, including: Improved 
site security inspections; improved risk assessment; and, a more 
streamlined and consistent Site Security Plan (SSP) authorization 
process. Most importantly, DHS leadership has demonstrated a 
willingness and commitment to work with the regulated community to help 
improve the program.
    While DHS has made considerable strides to enhance the CFATS 
program, more work needs to be done. ACC would like to offer the 
following recommendations for CFATS improvement:
    1. Ensure Multi-Year Authorization.--Recently, Congress approved a 
short-term (15 months) extension to the CFATS program, following a 
previous 4-year authorization period. Longer authorization periods 
provide important stability for planning security investments, as well 
as allowing DHS to efficiently manage the program. Periodic 
Congressional oversight of the program is also important for assessing 
the efficacy of CFATS to meet a changing security environment. 
Therefore, a multi-year reauthorization of the CFATS program is 
necessary to meet these key objectives: Oversight, stability, and 
efficiency.
    2. Assess the Value of TSDB Screening at Lower-risk Facilities.--
Over the past couple years, DHS has been implementing phase one of 
Risk-Based Performance Standard 12(iv), screening individuals for 
terrorist ties. Phase one was limited to approximately 240 of the 
highest-risk CFATS facilities in Tiers 1 and 2. This process requires 
CFATS facilities to collect sensitive personal information from 
thousands of employees and contractors and transmit that information 
over the internet to DHS for vetting against the Terrorist Screening 
Database (TSDB).
    DHS is planning to significantly expand this requirement to more 
than 3,000 lower-risk facilities, Tiers 3 and 4, involving tens of 
thousands of employees and contractors' personal information. ACC 
believes such an expansion is unnecessary and will needlessly create a 
security risk by exposing thousands of individual records to loss or 
cyber theft and operational interruptions (e.g., false positives, 
etc.). Further, the benefit associated with TSDB vetting at these 
lower-risk facilities is minimal at best. While we support TSDB vetting 
at highest-risk Tier 1 and Tier 2 facilities, we strongly recommend DHS 
reconsider this requirement for the lower risk, Tier 3 and Tier 4 
facilities.
    3. Improve Transparency in DHS Risk Determinations.--DHS should be 
more transparent with CFATS facilities regarding the specific factors 
driving risk at each location. Further, DHS should proactively engage 
CFATS facilities to reduce risk. CFATS facilities are not fully aware 
of the specific threat driving risk at a specified tier level. Site 
managers have the overall responsibility and authority for making 
critical security risk management decisions at CFATS facilities and are 
directly responsible for protecting the site and its operations. The 
facility manager or responsible security director should be fully 
informed by DHS of all details related to threat and risk. If needed 
this can be done in a Classified setting.
    4. Establish a CFATS Recognition Program.--DHS should leverage 
Industry Stewardship Programs, such as ACC's Responsible Care Security 
Code, by creating a Recognition Program under CFATS. By doing so, DHS 
would be able to recognize responsible operators for going beyond 
regulatory compliance and incentivize the creation of new stewardship 
programs. Performance data shows that facilities that participate in 
well-established stewardship programs perform better than their peers 
who do not, and better than the industry overall. By providing 
regulatory incentives, DHS can expand improved performance beyond the 
universe of the CFATS-regulated community and prioritize their efforts 
where they are needed the most. This would also help to lessen the 
burden of security regulation on industry partners that balance similar 
yet disparate requirements of other security regulations under USCG, 
DEA, TSA, FDA, etc.
    CFATS has helped make our industry and communities more secure. It 
is a program that will grow stronger by adopting the improvements 
outlined above and by the continued engagement of this committee to 
make sure CFATS stays on track.
                         maintain program focus
    It is also important that CFATS maintain its security focus. The 
continued success of the CFATS program will depend upon its ability to 
help manage security risks. CFATS should not stray into areas outside 
of its primary function of addressing security risks and into areas 
already addressed by well-established environmental and safety 
regulatory programs administered by other Federal and State agencies. 
Layering on additional responsibilities could impair its focus and will 
impede its progress toward the goal of protecting important critical 
infrastructure from security threats.
                  information sharing and coordination
    Coordinating with local emergency planners, first responders and 
law enforcement is essential to ensure an effective response during an 
incident at any facility, but especially at high-risk ones. In fact, it 
is in the facility's best interest to make sure this happens in order 
to protect its employees, local communities, and continuity of 
operations. It is equally important that the sharing of sensitive 
information is done on a need-to-know basis.
    The current regulatory framework strikes the right balance to 
ensure that those with a need to know have sufficient information to 
respond effectively. Risk-Based Performance Standard (RBPS) 11 requires 
CFATS facilities to coordinate emergency plans with local response 
groups. CFATS compliance inspectors will not approve a facility's Site 
Security Plan (SSP) if this coordination has not occurred.
    Protecting our people, communities, and operations from security 
risk is never taken lightly. We engage and include all the necessary 
experts and stakeholders to ensure our security plans are solid, 
comprehensive, and sustainable. If any issues arise, they can be 
addressed collaboratively. CFATS covers these important areas to help 
ensure that regulated facilities are taking a sound approach to 
developing security plans and providing opportunities for feedback.
                             cybersecurity
    Cybersecurity is an important element of a comprehensive security 
risk management system. Cyber requirements and needs vary greatly 
across a diverse chemical sector. CFATS includes Risk-Based Performance 
Standard (RBPS) 8, which is a performance standard that addresses the 
deterrence of cyber sabotage--including the prevention of unauthorized 
onsite or remote access to critical process controls and critical 
business systems, and other sensitive computerized systems. The level 
and degree of cyber protection expected at facilities increases in 
correlation to its level of cyber integration. ACC believes that DHS 
could do a better job in sharing cyber threat information with CFATS 
facilities. This data would be very helpful for facilities to 
prioritize risk evaluation and security planning. DHS inspectors should 
also be trained in the latest trends in cybersecurity threats against 
chemical operators and handlers so those trends can be shared with 
regulated facilities and plans can be adapted accordingly.
                               conclusion
    The long-term security of our Nation is a goal and a commitment 
that we all share. That is why ACC and its members encourage you to 
provide the necessary stability to this important security program and 
make the improvements that are needed to take CFATS to the next level 
while providing DHS with the appropriate Congressional oversight and 
guidance.

    Mr. Richmond. Thank you. I thank all the witnesses for 
their testimony.
    I will remind each Member that he or she will have 5 
minutes to question the panel.
    I will now recognize myself for 5 minutes to ask questions.
    I will start with Dr. Wilson. As a first responder I think 
you bring a unique perspective, so just a couple questions. 
Based on that first-responder experience, how is a lack of 
information for first responders putting that first responder 
at risk?
    Mr. Wilson. Well, in a number of ways, and it is an 
excellent question. One of the structural problems is that 
information is transmitted to local emergency response 
committees, LEPCs, and these are essentially volunteer 
committees set up by representatives from the safety and 
emergency response community.
    They are under--they are under-funded and I would say 
vastly over-tasked with what they are responsible for doing. 
Since 9/11 and Katrina, these LEPCs are responsible for 
industrial emergency response plans, for preparing communities 
for natural disasters and as well for terrorist attacks, and 
for transmitting information to first responders.
    I think there is good evidence to show that that structure 
needs to be re-evaluated, that--and that first responders need 
to get information that is timely, that is comprehensive. They 
need to be able to match that information to their experience.
    As I said in my testimony, in my written testimony, 
actually getting their hands and getting themselves into the--
the plants themselves to better understand what it is they are 
walking into in the event they are--that an emergency occurs at 
the facility.
    You know, in my experience it's--it was even difficult to 
get information in the first place and then it was very 
difficult to have an on-going cooperation with the industrial 
facilities in our jurisdiction.
    So as a consequence when we responded to industrial 
chemical releases, to fires at industrial facilities, there was 
a lot of uncertainty. Honestly I don't think we fully 
appreciated the risks that we were facing going into those 
incidents.
    Mr. Richmond. You mentioned the LEPCs. So I will go to Ms. 
Nixon now and ask, as a member of your local LEPC, can you tell 
us why emergency managers need to have some visibility into 
chemical security risks so they can protect their communities?
    Ms. Nixon. They need this because they are getting most of 
their information from the EPA's Risk Management Program and so 
it's difficult for them to know exactly all of the chemicals 
that are within the facilities. Then they have to transmit all 
that, as Mr. Wilson said, to the first responders.
    I know that during our 2008 fire and explosion at the 
Institute plant it was hours before the first responders knew 
exactly which unit it was that was burning and that had 
exploded.
    Even though they questioned them routinely over the radio 
over--through the dispatcher trying to find this information, 
it was difficult for them to get this information. So if they 
had all this information is--it's imperative that it is shared 
with our first responders.
    Mr. Richmond. Well--and this question I will just ask 
generally and maybe start with Ms. Meskill.
    In the event of an incident workers would likely be the 
first to answer the door when firefighters and police arrive. 
Is there a risk that if employees are not involved in a 
security plan emergency response could suffer almost like Ms. 
Nixon just spoke of?
    Ms. Meskill. Sure. So at BASF and I know at many of my peer 
colleagues in the ACC, employees are involved in security 
planning for all the reasons that were--been summarized today.
    The expertise is shared across the facility how to best 
prevent, contain, and react to an incident. So definitely for 
our company site security planning is very collaborative and 
includes many employees. It's absolutely essential that that 
planning extends to local emergency responders.
    I know at BASF and my peers in the chemical industry at ACC 
also proactively engage local law enforcement and emergency 
responders to participate in our emergency planning, our site 
security planning and in some cases even in, you know, table-
top exercise and insight drills and exercises.
    Mr. Richmond. I applaud that. My question would be--follow-
up question would be, do you think that every facility does 
that?
    I know you said BASF and many of your ACC but would you 
think that that is across the board 100 percent? Or do you just 
think it's a best practice that should be 100 percent?
    Ms. Meskill. Yes. Unfortunately I cannot comment as to 
whether or not it's done 100 percent, but it definitely is a 
best practice in security planning and emergency response 
planning.
    Mr. Richmond. Thank you.
    I now recognize the Ranking Member Mr. Katko for 5 minutes.
    Mr. Katko. Thank you, Mr. Chairman.
    Thank you all for your thoughtful testimony.
    A couple quick questions, Mr.--Dr. Wilson. First of all, 
thank you for your time as a first responder. Prior to coming 
to Congress I was on the front lines with organized crime cases 
and I have worked hand-in-glove with first responders on a 
daily basis, so I thank you for your service there.
    Have you heard of the term the chemical vulnerability 
information?
    Mr. Wilson. Was it chemical vulnerability information?
    Mr. Katko. Yes.
    Mr. Wilson. Sure.
    Mr. Katko. Yes. OK. So in order--first responders have 
access to that if they go through proper training, is that fair 
to say? That allows them to have access to what information--
what chemicals are in a facility?
    Mr. Wilson. They have access through the LEPCs through 
information on chemicals that are located and the quantities of 
those chemicals located at facilities in their jurisdiction, 
yes.
    Mr. Katko. Correct. In order to have access to that, the 
first responders have to get training. I guess my question is 
are the first responders getting the proper training and proper 
support to get that training so that they can have the 
information about each of these facilities?
    Mr. Wilson. I would respond to that by saying it really 
varies. In urban----
    Mr. Katko. That's my concern. Yes.
    Mr. Wilson. Yes. I think your concern is warranted. I think 
in urban areas we have some of the Nation's elite hazardous 
materials response teams. Those folks are well-trained. They 
are well-equipped. They are capable of responding.
    We also have rural departments, many, you know, that are 
served--in rural areas that are served by volunteers who have 
other jobs. I can tell you that one of the things that I did in 
serving with the FEMA National Response Team on Task Force Four 
out in--with the Oakland Fire Department was serving as an 
adjudicator for a large Bay Area exercise called Operation 
Urban Shield.
    I was a judge for really top-notch hazmat teams who were 
responsible for going through an exercise responding to a 
massive chlorine leak at a water treatment plant. I can tell 
you that even with those folks who understand the challenges 
they are up against and are well-resourced, it was--it's a 
difficult exercise.
    It's a high-consequence, low-frequency type of event and 
there is a lot of information that--and the situation is 
dynamic and changing every--and so there's both, as I said in 
my testimony, the need for both information and also routine 
access to these facilities----
    Mr. Katko. Right.
    Mr. Wilson. For firefighters and----
    Mr. Katko. OK. So that's my next--it's a good segue to my 
next question here.
    But first of all, I want to remind everyone that there is 
other--other agencies oversee the chemical distributors. Lord 
knows Ms. Meskill knows that. So the core function of CFATS is 
anti-terrorism.
    Mr. Wilson. Right.
    Mr. Katko. Right? So I am concerned that with the CFATS 
bill that we don't bleed into other things that are 
jurisdictions of other areas. CFATS is about anti-terrorism 
best practices. Right? So let's keep that in mind.
    So there are--and with that mind, sir, there is the 
Emergency Planning and Community Right to Know Act, there is 
the Clean Air Act's Risk Management Plan, there is a toxic 
release inventory requirement, Toxic Substances Control Act, as 
well as other Federal statutes, all of which allow you to 
accomplish some of these things. Isn't that fair to say?
    Mr. Wilson. It's not. Not quite. I mean, there are, you 
know, often large gaps, limitations with the Toxic Substance 
Control Act. We have had historic problems with the Risk 
Management Program and that was the subject of hearings under 
Executive Order 13650.
    Those corrections to the RMP Program were implemented under 
Executive Order 13650 and subsequently removed and the sort--
and that arena is sort-of in conflict still about what kinds of 
information should be transmitted to first responders and in 
what form.
    Mr. Katko. Right. I--I am sorry to interrupt you because I 
only have a little bit of time and I understand what you are 
saying. But wouldn't it be the purview of some of the other 
committees under those acts to fix those? My concern, again, is 
that CFATS should be laser-focused on the anti-terrorism 
component.
    But I agree that we need to fix those other things, if they 
are a concern.
    Mr. Wilson. Yes.
    Mr. Katko. But I am just wondering whether that--this is 
the right arena.
    Since I don't have enough time, Mr. Morawetz and Ms. Nixon, 
Ms. Meskill, I just note a couple of things here and perhaps 
one of my colleagues can pick up on it.
    Some employees do not have the security clearances to get 
access to some areas of chemical facilities because they have 
different screening levels. So if there's a concern about 
employee information, probably some of that should be 
designated to a high-level employee with the right screening 
should be there.
    Last, under the inherently safer technologies issue for 
chemical facilities there's a built-in incentive, I believe, 
for a chemical manufacturer to get the least volatile chemicals 
because if you get the--if you get a better IST rating or a 
better rating by the CFATS control because that the chemicals 
you have are not as volatile or dangerous, you get a better 
rating and get less oversight. So there's a built-in incentive 
there as well.
    With that, Mr. Chairman, I yield back.
    Mr. Richmond. Thank you.
    I now recognize Mr. Langevin.
    Mr. Langevin. Thank you, Mr. Chairman.
    I want to thank our witnesses for your testimony here 
today. I also want to extend my condolences to our 
Representative Katko on the loss of his father and welcome him 
back to the subcommittee.
    So I want to look at another aspect of security that is 
focused on cybersecurity at these facilities. Mr. Morawetz in 
your testimony you highlight the importance of training to the 
workers at chemical facilities, and I am particularly 
interested in the cybersecurity training.
    I think that the old adage we are only as strong as your 
weakest link certainly applies in this case.
    So what type of cybersecurity training do most workers at 
chemical facilities receive today?
    Again, you click on the wrong link, you, you know, you 
download a piece of malware, you could put everybody at risk. 
So I--I am looking at what type of cybersecurity training do 
most workers receive at these facilities?
    Mr. Morawetz. Cybersecurity is really not my area of 
expertise, so it is limited what I can say about it. I do know 
though that in the limited number of control rooms that I have 
been in these are very sophisticated operations and I can only 
imagine the kind of training that needs to be sure adequate 
protections are taken. But it's really not my area.
    Mr. Langevin. OK. Well, I bring this up because I need to--
it is an important topic that, again, all workers need to be 
cyber-conscious, if you will, particularly people that are in 
the control rooms.
    But, you know, bringing in your home laptop and plugging it 
in somehow to the network and the systems administrator is not 
aware of it and you have got malware on your computer then you 
have potentially just infected the system of the entire 
facility and could potentially have very serious consequences.
    So I think that's something that really needs to be built 
into the culture of the organization just as a regular part of 
the training.
    The reason I bring this up, Mr. Chairman, is that my 
colleague Mr. Thompson and I have introduced a bipartisan piece 
of legislation to help ensure that our career and technical 
education programs in our high schools or--or even at community 
colleges incorporate cybersecurity, particularly within the 
critical area of the critical infrastructure.
    I certainly hope that our Cybersecurity Skills Integration 
Act is going to help improve the security at the chemical 
sector as well.
    Let me turn to Ms. Meskill. Staying on the topic of 
cybersecurity, if I could ask you what metrics does your 
industry use to assess your cybersecurity posture?
    Ms. Meskill. Thank you very much for the question. We 
have--BASF being an extremely large organization, and as I 
stated earlier, hundreds of facilities, different types of 
facilities, manufacturing, distribution, R&D, we have multi-
levels of cyber risk. So the metrics that we use really look 
across that spectrum and we do take the risk-based approach.
    So we are looking at, you know, risks that might come up in 
an administrative building, so trade secrets and things of that 
nature. R&D where it might be attacked by, again competitors or 
others trying to steal our innovation. Then, of course, to the 
topic that you already referred to, to our industrial control 
systems.
    So once we understand the risks then we start layering our 
security planning on top of it. It is rooted, very much as you 
suggested, in strong employee awareness of what that risk might 
be in the area that they are operating in.
    Bringing it back to the point that Chairman Richmond, you 
know, originally pointed out, was employee involvement. If they 
hear something, say something. They are the folks that are 
going to be most keenly aware of something that's not right.
    So the metrics that we are using to evaluate our programs 
really span, I think, to understanding what the risk is that's 
undermining our ability to do what we are doing or the safety 
and security of our employees.
    It's really looking at awareness across our employee base. 
We have got 20,000 folks working, you know, just employees and 
you layer on top of that contractors. Our awareness efforts 
also extend to them as well. We have got to make sure that 
these guys are understanding what might look strange and then 
know how to respond to it and report it.
    Mr. Langevin. Yes, yes. Excellent points in your answer. 
Thank you.
    Can you--do you happen to know how often you refresh the 
metrics that you use? Is there an annual audit, or something 
quarterly?
    Ms. Meskill. It's constant. So these areas are being 
reviewed by internal audit, by our I.T. function, by our 
security function, by our Responsible Care auditing function, 
and cybersecurity is a topic that they are reviewing. 
Information protection actually is what we call it within in 
our organization. So they are constantly looking at it.
    Mr. Langevin. Thank you very much. I appreciate your 
answer. My time has expired, but thank you.
    I yield back.
    Mr. Richmond. I thank the gentlemen.
    I will now recognize Mr. Walker from North Carolina.
    Mr. Walker. Thank you Mr. Chairman. Thank you for calling 
this hearing.
    I--Ms. Meskill, you seem to be the one getting the most 
questions, but I do have a few more for you and I appreciate 
your patience and certainly the entire panel. As you know, DHS 
has implemented the Personal Surety Program at the Tier 1 and 
Tier 2 facilities. My question is--first question is do you 
have any feedback on how that's going at this point?
    Ms. Meskill. At this point, the feedback that I will share 
from my own organization is when we went through the process it 
was smooth and it's fine. I am hearing pretty much the same 
from my peers in the ACC. There were some initial hiccups, as 
you would expect, but now those seem to have been ironed out.
    Mr. Walker. As you look, I guess, potentially to implement 
some of the changes in the Tiers 3 and 4, would you speak to 
talking about maybe the challenges that would exist in 
implementing such a program?
    Ms. Meskill. Absolutely. So as it happens, at BASF and I 
think at many of the companies of our size, many of our 
facilities we have worked to reduce our risk and so we are now 
down to either 3 or 4 tier levels.
    So as I mentioned earlier, this is an enormous number of 
folks that we have to do the additional screening on. But 
perhaps the more complicated would be the contractors and 
visitors that we have on-site. That's where it gets a little 
bit--a lot more complicated to ensure that all those 
individuals that are coming on to our site day-in, day-out have 
gone through the screening process. It's costly. It's very 
expensive, needless to say, for us as well as for the 
contractors that support us.
    Mr. Walker. So that would be one of the challenges for the 
cost as well?
    Ms. Meskill. Correct.
    Mr. Walker. Ms. Meskill, how would you rate the 
coordination with State and local officials to improve 
emergency management operations? Would you speak to that?
    Ms. Meskill. Sure. So again, we take a very proactive 
approach at BASF, and I know my peers in ACC do as well, to 
ensure that we are networking and coordinating with local law 
enforcement, State and Federal, as well as emergency 
responders. Our primary responsibility is the safety of our own 
people and the continuity of operations, the protection or the 
communities that we work in. We recognize our responsibility to 
do that.
    The best way that we can do that is ensuring that our local 
responders and law enforcement officials understand our plans, 
know who we are, are familiar with our facilities, and that our 
efforts to contain, prevent, and mitigate these threats are 
completely aligned and collaborated with them.
    Mr. Walker. That's a great goal. Can you unpack that a 
little bit more and tell me the intentionality that it takes to 
be able to build that relationship?
    Ms. Meskill. It's constant, again. So I am not familiar 
with any cases where we have been turned down or where a local 
law enforcement, State or Federal entity or emergency responder 
has not welcomed that opportunity.
    But as referenced earlier by Dr. Wilson, it is something 
that needs to happen at least annually. I know our sites strive 
to have that meeting--conversation at least annually to, you 
know, talk about any changes, particularly as people rotate 
through positions.
    Mr. Walker. Ms. Meskill, how has stakeholder engagement 
been enhanced since the beginning of the CFATS program? How in 
your opinion can it be regionally improved as we move forward?
    Ms. Meskill. I am sorry. Could you clarify stakeholder?
    Mr. Walker. Yes. The stakeholder specifically is the 
engagement of those that may have some kind of interest or 
connection with your organization.
    Ms. Meskill. OK. So external----
    Mr. Walker. Yes.
    Ms. Meskill. As well as internal. I cannot comment as to 
whether CFATS has improved that because it's already, as I 
mentioned earlier, a best practice for emergency response 
planning and site security planning. So I believe that 
engagement at least at BASF was occurring--would have occurred 
with or without CFATS.
    Mr. Walker. It would--it--fair enough. If you are not 
comfortable with stakeholder then maybe this final question if 
you could elaborate on it? It's where is engagement by the DHS 
lacking?
    Ms. Meskill. OK, for DHS. We have not experienced a gap 
with DHS. There perhaps was when they implemented the new risk-
tiering levels and they needed to educate inspectors as to the 
new standards and requirements, but those, again, were part of 
working in a new program.
    I think they have addressed the issue. As soon as they 
heard industry raise it as a concern, they addressed it and now 
we are quite satisfied with that level of support.
    Mr. Walker. Well, thank you for your expertise in this 
area.
    Ms. Meskill. Thank you.
    Mr. Walker. With that, I yield back, Mr. Chairman.
    Mr. Richmond. Thank you, Mr. Walker.
    I now would like to recognize the gentlewoman from New 
York, Miss Rice.
    Miss Rice. Thank you, Mr. Chairman.
    I want to thank you all for coming here today to talk about 
this very important issue. As one of the founders and co-chairs 
of the House Whistleblower Protection Caucus, I am very 
concerned to hear that facility employees and union 
representatives have been left out of the development and 
implementation of whistleblower programs at chemical 
facilities.
    So Mr. Wilson, I think I will give--address my questions to 
you. What is the current process for an employee to report a 
concern and how is DHS disseminating information on appropriate 
whistleblower procedures to facility employees?
    Mr. Wilson. For--my understanding is that there are 
whistleblower protections within CFATS, but the ways in which 
that's actually implemented out in the field it's not clear to 
me.
    It's also not clear in looking through the risk-based 
performance standards if inspections include an assessment of 
whether and to what extent whistleblowers, you know, have been 
protected or have been retaliated against in some way or 
another.
    Miss Rice. Well, have you heard of any specific 
whistleblower retaliation cases that--at any CFATS facility, 
you personally?
    Mr. Wilson. I have not personally, no.
    Miss Rice. Do you know if DHS requires training for all 
facilities covered by CFATS on how to appropriately handle 
whistleblower complaints?
    Mr. Wilson. My understanding, again, in looking through the 
risk-based performance standards and the guidance documents is 
that their training around the handling of whistleblowers and 
the protection of whistleblowers from retaliation would be a 
helpful addition to the program.
    Miss Rice. Does DHS need additional statutory authority to 
compel facility owners and operators with whistleblower 
regulations?
    Mr. Wilson. I think that would be a benefit as well, yes.
    Miss Rice. So are you aware of GAO's recommendations in 
regards to whistleblower retaliation that DHS has not yet 
implemented--any of those recommendations that they have not 
yet implemented?
    Mr. Wilson. My--in looking through the GAO reports my 
recollection is that those have not yet been--have not yet been 
implemented.
    Again though, I would have to look at the GAO reports a 
little more carefully.
    I recall that they have been looking for a way to formalize 
those complaints and to surface them and ensure that employees 
know that they have the right to call attention to a problem 
and that they can do so without fear of retaliation, that 
there's a system for doing that and there's notification within 
their workplaces to that effect.
    Miss Rice. So, would you agree with DHS's assessment that 
it does not have the authority to pressure facilities to comply 
with whistleblower regulations?
    Mr. Wilson. It's--that's a little bit outside of my 
expertise. But my--in reading just simply, you know, a read of 
the statute itself, it does have whistleblower protection. But 
DHS, you know, would have to make a determination to that 
effect.
    Miss Rice. Ms. Meskill, can you answer that question?
    Ms. Meskill. Would you please repeat the question?
    Miss Rice. Do you agree with DHS's assessment that it does 
not have the authority to pressure facilities to comply with 
whistleblower regulations?
    Ms. Meskill. No, I am sorry. I can't comment on that 
question as far as DHS authority.
    Miss Rice. OK. But any whistleblower--are you aware of any 
whistleblower issues?
    Ms. Meskill. No, none at all. We have our own, of course, 
internal means for employees to escalate concerns and issues.
    Miss Rice. OK.
    Ms. Meskill. Yes.
    Miss Rice. Does DHS issue guidance for cyber--I don't know 
if you--if Mr. Langevin asked this question, but does DHS issue 
guidance for cybersecurity standards that CFATS facilities have 
to meet? Yes.
    Ms. Meskill. Yes, they do. They--in the risk-based 
performance standard there are guidelines for cybersecurity, 
yes.
    Miss Rice. Let me just ask you to expound on a comment that 
you made before about when you gave a list of 4 
recommendations. You were talking about a concern that you had 
about the value of testing on lower-level facilities and what 
that would encompass in terms of the number of employees and 
the privacy issue. Can you just expound a little bit----
    Ms. Meskill. Sure.
    Miss Rice [continuing]. More on that?
    Ms. Meskill. Sure. This is going back to the question that 
was raised before. It has to do with the terrorist database 
screening of employees and contractors at lower-risk 
facilities.
    Miss Rice. What are your specific concerns about that?
    Ms. Meskill. Our concerns are exposing personal data of 
thousands of--more thousands and thousands and thousands of 
employees and contractors for this terrorist database screening 
and whether the value actually is there for the cost and for 
the potential risk of exposing this personal data to 
cybersecurity risks.
    Miss Rice. But don't you think that's one of the core ways 
to ensure security at these facilities?
    Ms. Meskill. Well, we are conducting our own background 
screening anyway, which includes, you know, criminal background 
checks also, so it seems duplicative, yes.
    Miss Rice. So have you communicated that?
    Ms. Meskill. Yes.
    Miss Rice. Are there any questions that they include in 
their review of their background check that you do not?
    Ms. Meskill. I cannot answer that question. I am not--I 
don't know the answer to that.
    Miss Rice. OK.
    Thank you, Mr. Chairman.
    Mr. Richmond. Thank you.
    The gentleman from Texas, Mr. Taylor, is recognized.
    Mr. Taylor. Thank you, Mr. Chairman. Thank you for having 
this hearing.
    Ms. Meskill, just a question for you about CFATS 
facilities. So I know that you have, as Mr. Katko was saying 
earlier, multiple regulatory entities coming in, you know, 
looking at all kinds of different things. In terms of the 
counterterrorism piece, the security piece, is the--is DHS the 
only counterterrorism security regulatory body that you deal 
with?
    Ms. Meskill. No. So--thank you very much for the question.
    So again, looking at the perspective--my perspective as 
security director for BASF with--which has, you know, over 100 
manufacturing facilities in North America, we are exposed to or 
complying with additional Federal security regulations, so 
really looking at security planning and security measures. That 
includes the U.S. Coast Guard at several of our sites, where 
they have jurisdiction, of course, DHS and CFATS, 
transportation security.
    We also have for our drug precursors, DEA security 
requirements that we need to comply with, Food Defense 
Administration for any food-grade chemicals that we are 
manufacturing or handling. So yes, there are extensive 
regulatory security, really focused on security measures, 
regulations that we need to consider and comply with.
    Mr. Taylor. So, does that--by having multiple groups coming 
in and saying, hey, move this over here, no, no move that over 
there, are you getting conflicting regulation--I mean, so in 
other words, one regulator says one thing one month, the next 
regulator says another thing another month, and so you are--I 
mean it is just--it is difficult, because you got different 
people----
    Ms. Meskill. It is difficult.
    Mr. Taylor [continuing]. That want different things----
    Ms. Meskill. Yes.
    Mr. Taylor. So rather than having one consistent, you know, 
coach you have got multiple coaches telling you what to do.
    Ms. Meskill. Correct. So I would say conflicting, most 
likely not, because security best practice in those measures 
are usually pretty much the same. But keeping track of all of 
those regulations as a security director, but then working with 
our business partners and facility managers and directors to 
understand which security measure they need to implement is 
where the complexity arises.
    Then layered on top of that, of course, is the additional 
responsibility that we have already taken on ourselves. So we 
have our own internal security practices and requirements that 
we need to comply with, as well as the Responsible Care 
Security Code.
    So when I talk about tiering, just to give you an example, 
to paint a picture for you, when I talk about tiering a site, 
such as Chairman Richmond's, you know, in his district, I have 
four different tiers that I can use to describe that site.
    So that is where the level of complexity comes in. Each of 
those tiers is looked through a different lens of security.
    Mr. Taylor. I am sure you would view it favorably if 
Congress moved to simplify that----
    Ms. Meskill. Absolutely.
    Mr. Taylor. Just to make it easier to do your job and to do 
what we are all trying to do here.
    Ms. Meskill. It's not just easier. It's really keeping our 
focus. So what I think everybody here can agree with that you 
want to make sure that chemical manufacturers and handlers are 
completely focused all the time on the security risk, on the 
terrorist risk.
    If I am spreading that focus across many different 
regulations, then it can get distracting. If I am more focused 
on complying with regulation, rather than managing the threat 
to my site, then I am potentially gonna lose focus. I think 
that's the greater concern.
    Mr. Taylor. Right.
    Mr. Chairman, I would like to yield my time to Ranking 
Member Katko.
    Mr. Richmond. The gentleman is recognized.
    Mr. Katko. Thank you, Mr. Chairman. Thank you, Mr. Taylor, 
for yielding time.
    So I have just got a quick question. Does the CFATS--anyone 
aware that CFATS has what is a--a tip line program? The reason 
I ask that is if they have it why isn't it being used more by 
employees?
    If there's something we need to do to beef that up, to help 
incentivize employees in a confidential nature to come forward 
with information, if they have concerns. Anybody?
    Mr. Morawetz. I would say the basic question is how much do 
our labor unions and the members know about the hotlines?
    Mr. Katko. Yes. That's my concern.
    Mr. Morawetz. The problem is we have been having 
discussions with CFATS about the possibility of publicizing it 
in a way that's confidential, where it needs to be, that 
information, but it hasn't happened yet. We would be open, and 
it is in my testimony, a way that workers can know just like 
there are posters about OSHA, posters about minimum wage, a 
simple way people can know without identifying what tier you 
are on, if you are in danger, here's what you are doing----
    Mr. Katko. Right. It might ameliorate some of the--some of 
my colleague Ms. Rice's concerns about whistleblower 
retaliation. But it seems like something we can do to help 
incentivize that program and do something to force the Homeland 
Security to better publicize that in all the facilities.
    Does that make sense, Ms. Meskill?
    Ms. Meskill. Sure. It could definitely help. I think it's 
one poster among many. If you have been to a manufacturing 
facility and you have seen that wall, there's probably 15 
posters. But no, definitely I think it could help for sure.
    Mr. Katko. OK. Well, we will get you off-line. Maybe if you 
have some ideas afterwards that you could submit to me in 
writing, I would appreciate it. Because I would like to figure 
out how we can just incentivize people to kind-of fill that gap 
a little bit by saying, you know, hey, you have an anonymous 
way of doing this, if you don't want to get involved with the 
whole whistleblower thing.
    I think that would help the unions feel more empowered as 
well. So I would love--I would welcome your input on that.
    I yield back, Mr. Chairman.
    Mr. Richmond. Thank you.
    The gentlewoman from Texas, Ms. Jackson Lee, is recognized.
    Ms. Jackson Lee. Mr. Chairman, thank you very much for 
holding this hearing.
    Thank you to the witnesses.
    Mr. Morawetz, I am concerned about the workers, who every 
day are--certainly the community, because many of the workers 
live in the community.
    Likewise, Ms. Nixon, concerned about communities and we 
want to make sure that they are safe. So I know that during a 
chemical incident, for example, time can mean lives and 
knowledge about what chemicals are involved can help make the 
right decisions in first responders easier.
    So Mr. Morawetz, would you share with me the--on the issue 
of providing insight on how the lack of information about a 
facility or the chemicals can hinder the safety and security of 
the members, the workers because they may be working with 
chemicals that no one has apprised them of or the facility or 
the surrounding area.
    I am reminded of a terrible incident in Texas that many of 
you may be aware of, would flatten the whole area and schools, 
and we only were saved, if you will, in terms of lives--
extensive lives lost because it was a weekend.
    Mr. Morawetz, the knowledge of what the chemicals are?
    Mr. Morawetz. Thank you, Ms. Lee. Well, actually Texas has 
been the scene of a number of incidents with Hurricane Harvey. 
I believe there was a facility that blew up many days 
afterwards. As I mentioned in my testimony, 4 workers died in a 
facility in Houston.
    As I put in my testimony, one problem is the knowledge that 
workers have, under another jurisdiction, is under OSHA, is a 
one-time deal. It is basically--it has communication and you 
are trained once and that's it.
    Under the realm of Homeland Security, I would say that 
you--there is a role that CFATS can play to say--to mitigate 
the possibility of an incident happening and what can happen 
afterwards. That training should be enhanced. I--I am not fully 
aware of the CFATS inspectors' training, but that's part of it 
also.
    The other thing I would say, that in terms of knowledge, 
the other question is what do you do with that knowledge? Part 
of the problem that's been alluded to is emergency responders. 
Our members, as well as salaried people, are on joint emergency 
response teams.
    One thing you could enhance is the ability and the mandate 
to say you have to train. You have to train internally. You 
have to train with the LEPCs, so local first responders. We 
have found if people don't drill that things fall apart and 
some of those tragedies are really horrendous.
    Ms. Jackson Lee. Thank you so very much. I am intending to 
introduce again the Frank Lautenberg Chemical Facility 
Cybersecurity Act. I know that with all of our excellent 
workers that we are moving to more of a cyber system in many of 
our facilities. What happens when a cyber attack, combined with 
chemicals, is potentially unspeakable.
    So we have computer programs that need to be secured, and 
Mr. Morawetz, you are making a very good point that I am going 
take up on because I am very interested in that in terms of the 
training. I think that training should also involve the 
cybersecurity system.
    So Mr.--Dr. Wilson, do you feel able to comment on that, 
the cybersecurity system?
    Mr. Wilson. If there's a specific question regarding 
cybersecurity, could you repeat that?
    Ms. Jackson Lee. The importance of also assessing the cyber 
system in a chemical plant.
    Mr. Wilson. That's outside my area of expertise.
    Ms. Jackson Lee. OK.
    Let me conclude my comments, Mr. Chairman. We are in an 
infrastructure committee as well, and we do not have this 
matter before us, but I just feel compelled just to make a 
comment on the recent tragedy dealing with the Ethiopian 
airlines.
    I know that we have a lot of responsibilities. I consider 
that a security issue, and frankly, believe that the FAA should 
ground the 737 MAX 8 to protect the lives of individuals 
because pilots and flight attendants and passengers count.
    So I thank the gentleman, and I yield back my time.
    Mr. Richmond. I also share the gentlelady's concern, 
especially the neighborhood schools and other facilities that 
our planes fly over.
    Let me just thank the witnesses for their valuable 
testimony, and the Members for their questions. The Members of 
the committee may have additional questions for the witnesses, 
and we ask that you respond expeditiously in writing to those 
questions.
    Hearing no further business, the committee stands 
adjourned.
    [Whereupon, at 11:16 a.m., the subcommittee was adjourned.]



                            A P P E N D I X

                              ----------                              

    Questions From Chairman Bennie G. Thompson for John S. Morawetz
    Question 1a. The CFATS Act of 2014 directs DHS to provide ``such 
information as is necessary to help ensure that first responders are 
properly prepared and provided with the situational awareness'' to 
respond to an incident at a CFATS facility.
    Last year, GAO reported that CFATS information is still not making 
it into the hands of first responders and emergency managers 
consistently, especially at the local level. How does this put first 
responders at risk?
    Answer. Response was not recieved at the time of publication.
    Question 1b. GAO also reported that, without consistent access to 
CFATS information, first responders have to rely on information 
reported to EPA under the Emergency Preparedness and Community Risk to 
Know Act (EPCRA). Is the EPCRA framework for information sharing 
adequate? How do the information-sharing provisions under CFATS compare 
with EPCRA?
    Answer. Response was not recieved at the time of publication.
    Question 2a. You mentioned the importance of facilities not only 
managing risk, but also working to eliminate or reduce those risks when 
it is possible, and depending on factors like cost and the unique 
conditions on-site.
    What are some of the ways facilities can modify, reduce, or 
eliminate risk?
    Answer. Response was not recieved at the time of publication.
    Question 2b. One of the promising aspects of CFATS is that, over 
the years, it has encouraged thousands of facilities to voluntarily 
modify chemicals or processes in ways that lower their risk profile, 
and as a result, their overall regulatory burden. Is there an 
opportunity for DHS to use that data to develop a flexible set of best 
practices on how facilities are making these modifications?
    Answer. Response was not recieved at the time of publication.
    Question 3a. While the location of CFATS facilities is not publicly 
available, research has shown that facilities with dangerous chemicals 
tend to be concentrated low-income and minority communities. That means 
these communities are exposed to a disproportionate share of chemical 
safety hazards, and disproportionately vulnerable to chemical security 
risks.
    For communities with multiple high-risk facilities, is it possible 
the close proximity of these facilities could exacerbate the impact of 
a security incident or terrorist attack? Or, make that community a 
prime target for a terrorist?
    Answer. Response was not recieved at the time of publication.
    Question 3b. Should DHS consider the presence of multiple chemical 
facilities clustered together as part of its risk assessment?
    Answer. Response was not recieved at the time of publication.
    Question 3c. Are there ways DHS and other regulators could work 
with these communities to make sure, for instance, that they have 
sufficient first-responder capacity and emergency response plans?
    Answer. Response was not recieved at the time of publication.
    Question 3d. Are there resources available through other Federal 
regulators, like the EPA's EJ Screen tool, that DHS could use to better 
understand communities where CFATS facilities are located?
    Answer. Response was not recieved at the time of publication.
    Question 4a. The CFATS Act of 2014 has some limited requirements 
for facility owners and operators to consult with at least 1 
knowledgeable employee and/or labor union representative in the 
security planning process, but only ``to the extent practicable.''
    Can you elaborate on the benefit of having employees on the ground 
contribute to security plans and serve as force multipliers for 
monitoring compliance?
    Answer. Response was not recieved at the time of publication.
    Question 4b. How would you characterize the level of engagement 
between owners, operators, and workers at CFATS facilities?
    Answer. Response was not recieved at the time of publication.
    Question 4c. The CFATS Act of 2014 also establishes a whistleblower 
process for employees to report potential CFATS violations. If 
employees do not know their facility is subject to CFATS, or have never 
heard of the CFATS program to begin with, how can they be expected to 
report violations?
    Answer. Response was not recieved at the time of publication.
    Question 5a. The CFATS program is supposed to be identifying the 
Nation's highest-risk chemical facilities. In the past, there have been 
questions about the metrics DHS uses to assess risk, and whether those 
metrics are comprehensive enough to consider the full range of 
consequences. As a result, CFATS may be defining ``high-risk'' too 
narrowly and leaving many facilities insecure.
    Right now, DHS does not consider nearby infrastructure, like 
hospitals, schools, power plants, military bases, or other sensitive 
buildings, in calculating risk. Should DHS consider these factors?
    Answer. Response was not recieved at the time of publication.
    Question 5b. Similarly, DHS considers potential loss of life, but 
not adverse health consequences of chemical exposure. Is it fair to say 
that human illness and injury could result from a chemical attack?
    Answer. Response was not recieved at the time of publication.
    Questions from Chairman Bennie G. Thompson for Michael P. Wilson
    Question 1a. The CFATS Act of 2014 directs DHS to provide ``such 
information as is necessary to help ensure that first responders are 
properly prepared and provided with the situational awareness'' to 
respond to an incident at a CFATS facility.
    Last year, GAO reported that CFATS information is still not making 
it into the hands of first responders and emergency managers 
consistently, especially at the local level. How does this put first 
responders at risk?
    Answer. Response was not recieved at the time of publication.
    Question 1b. GAO also reported that, without consistent access to 
CFATS information, first responders have to rely on information 
reported to EPA under the Emergency Preparedness and Community Risk to 
Know Act (EPCRA). Is the EPCRA framework for information sharing 
adequate? How do the information-sharing provisions under CFATS compare 
with EPCRA?
    Answer. Response was not recieved at the time of publication.
    Question 2a. You mentioned the importance of facilities not only 
managing risk, but also working to eliminate or reduce those risks when 
it is possible, and depending on factors like cost and the unique 
conditions on-site.
    What are some of the ways facilities can modify, reduce, or 
eliminate risk?
    Answer. Response was not recieved at the time of publication.
    Question 2b. One of the promising aspects of CFATS is that, over 
the years, it has encouraged thousands of facilities to voluntarily 
modify chemicals or processes in ways that lower their risk profile, 
and as a result, their overall regulatory burden. Is there an 
opportunity for DHS to use that data to develop a flexible set of best 
practices on how facilities are making these modifications?
    Answer. Response was not recieved at the time of publication.
    Question 3a. While the location of CFATS facilities is not publicly 
available, research has shown that facilities with dangerous chemicals 
tend to be concentrated low-income and minority communities. That means 
these communities are exposed to a disproportionate share of chemical 
safety hazards, and disproportionately vulnerable to chemical security 
risks.
    For communities with multiple high-risk facilities, is it possible 
the close proximity of these facilities could exacerbate the impact of 
a security incident or terrorist attack? Or, make that community a 
prime target for a terrorist?
    Answer. Response was not recieved at the time of publication.
    Question 3b. Should DHS consider the presence of multiple chemical 
facilities clustered together as part of its risk assessment?
    Answer. Response was not recieved at the time of publication.
    Question 3c. Are there ways DHS and other regulators could work 
with these communities to make sure, for instance, that they have 
sufficient first-responder capacity and emergency response plans?
    Answer. Response was not recieved at the time of publication.
    Question 3d. Are there resources available through other Federal 
regulators, like the EPA's EJ Screen tool, that DHS could use to better 
understand communities where CFATS facilities are located?
    Answer. Response was not recieved at the time of publication.
    Question 4a. The CFATS Act of 2014 has some limited requirements 
for facility owners and operators to consult with at least 1 
knowledgeable employee and/or labor union representative in the 
security planning process, but only ``to the extent practicable.''
    Can you elaborate on the benefit of having employees on the ground 
contribute to security plans and serve as force multipliers for 
monitoring compliance?
    Answer. Response was not recieved at the time of publication.
    Question 4b. How would you characterize the level of engagement 
between owners, operators, and workers at CFATS facilities?
    Answer. Response was not recieved at the time of publication.
    Question 4c. The CFATS Act of 2014 also establishes a whistleblower 
process for employees to report potential CFATS violations. If 
employees do not know their facility is subject to CFATS, or have never 
heard of the CFATS program to begin with, how can they be expected to 
report violations?
    Answer. Response was not recieved at the time of publication.
    Question 5a. The CFATS program is supposed to be identifying the 
Nation's highest-risk chemical facilities. In the past, there have been 
questions about the metrics DHS uses to assess risk, and whether those 
metrics are comprehensive enough to consider the full range of 
consequences. As a result, CFATS may be defining ``high-risk'' too 
narrowly and leaving many facilities insecure.
    Right now, DHS does not consider nearby infrastructure, like 
hospitals, schools, power plants, military bases, or other sensitive 
buildings, in calculating risk. Should DHS consider these factors?
    Answer. Response was not recieved at the time of publication.
    Question 5b. Similarly, DHS considers potential loss of life, but 
not adverse health consequences of chemical exposure. Is it fair to say 
that human illness and injury could result from a chemical attack?
    Answer. Response was not recieved at the time of publication.
      Questions from Chairman Bennie G. Thompson for Pamela Nixon
    Question 1a. The CFATS Act of 2014 directs DHS to provide ``such 
information as is necessary to help ensure that first responders are 
properly prepared and provided with the situational awareness'' to 
respond to an incident at a CFATS facility.
    Last year, GAO reported that CFATS information is still not making 
it into the hands of first responders and emergency managers 
consistently, especially at the local level. How does this put first 
responders at risk?
    Answer. Response was not recieved at the time of publication.
    Question 1b. GAO also reported that, without consistent access to 
CFATS information, first responders have to rely on information 
reported to EPA under the Emergency Preparedness and Community Risk to 
Know Act (EPCRA). Is the EPCRA framework for information sharing 
adequate? How do the information sharing provisions under CFATS compare 
with EPCRA?
    Answer. Response was not recieved at the time of publication.
    Question 2a. While the location of CFATS facilities is not publicly 
available, research has shown that facilities with dangerous chemicals 
tend to be concentrated low-income and minority communities. That means 
these communities are exposed to a disproportionate share of chemical 
safety hazards, and disproportionately vulnerable to chemical security 
risks.
    For communities with multiple high-risk facilities, is it possible 
the close proximity of these facilities could exacerbate the impact of 
a security incident or terrorist attack? Or, make that community a 
prime target for a terrorist?
    Answer. Response was not recieved at the time of publication.
    Question 2b. Should DHS consider the presence of multiple chemical 
facilities clustered together as part of its risk assessment?
    Answer. Response was not recieved at the time of publication.
    Question 2c. Are there ways DHS and other regulators could work 
with these communities to make sure, for instance, that they have 
sufficient first-responder capacity and emergency response plans?
    Answer. Response was not recieved at the time of publication.
    Question 2d. Are there resources available through other Federal 
regulators, like the EPA's EJ Screen tool, that DHS could use to better 
understand communities where CFATS facilities are located?
    Answer. Response was not recieved at the time of publication.
    Question 3. In February, DHS testified that they have done outreach 
to ``literally thousands'' of local emergency planning committees 
(LEPCs), including 800 LEPCs last year alone. You've served on your 
LEPC for over a decade--and, your community is home to 4 CFATS 
facilities, 2 of which are in the highest-risk tier. How would you 
characterize the outreach you have received from DHS thus far?
    Answer. Response was not recieved at the time of publication.
    Question 4a. The CFATS program is supposed to be identifying the 
Nation's highest-risk chemical facilities. In the past, there have been 
questions about the metrics DHS uses to assess risk, and whether those 
metrics are comprehensive enough to consider the full range of 
consequences. As a result, CFATS may be defining ``high-risk'' too 
narrowly and leaving many facilities insecure.
    Right now, DHS does not consider nearby infrastructure, like 
hospitals, schools, power plants, military bases, or other sensitive 
buildings, in calculating risk. Should DHS consider these factors?
    Answer. Response was not recieved at the time of publication.
    Question 4b. Similarly, DHS considers potential loss of life, but 
not adverse health consequences of chemical exposure. Is it fair to say 
that human illness and injury could result from a chemical attack?
    Answer. Response was not recieved at the time of publication.
    Question 5a. In 2008, a Bayer pesticide plant explosion in your 
area of West Virginia sparked a National controversy after the CEO 
acknowledged during Congressional testimony that he had advised 
officials to refuse information to first responders, and mark records 
as sensitive security information that were unrelated to security, in a 
blatant effort to conceal information from first responders, law 
enforcement, and Federal regulators. Over 10 years have passed since 
that incident.
    Through your work with the Environmental Justice and Health 
Alliance, do you still encounter issues with chemical companies 
refusing to provide information on National security grounds?
    Answer. Response was not recieved at the time of publication.
    Question 5b. Are there areas where further improvement is needed 
when it comes to sharing information about chemical security risks?
    Answer. Response was not recieved at the time of publication.

                                 [all]