Remarks by Assistant Secretary for Infrastructure Protection Robert B. Stephan at a Pen and Pad Media Briefing on the Release of Appendix A of the Chemical Facility Anti-Terrorism Standards

Release Date: November 5, 2007

Ronald Reagan Building
Washington, DC

Mr. Stephan: Okay. Well, folks, thank you very much. It's been an exciting day for me. I refer to this day as my appendectomy. I'm getting Appendix A out and there's quite a lot of national and international attention on this.

It is an important event, because this is the next step in a very complex process that was begun with the authority we received for our 2007 appropriations act to develop and implement a very comprehensive security framework, security regulatory framework for high risk elements of the chemical sector of the United States. It’s never been done before.

The legislation that we received the last week in October, so we've just crested over the one-year anniversary of the authority given to us was about a page and a half long. So a page and a half of statutory authority to develop and implement, execute now, a very complex regulatory framework. This Appendix A, that's a little bit of bureaucratic jargon.

Appendix A is important, because Appendix A defines the universe of things that will enter the first step in our regulatory process. It's very important that everyone understands that that the regulatory universe or the regulated universe, those chemical facilities or those users of chemicals of concern that are on this list now were not identified in the authorizing legislation.

So my team has had to spend a lot of time to get it right in terms of what is this universe of things to which the regulatory authority applies. So understanding that this has an incredible amount of scrutiny attached to it, understanding that we have to achieve a balance in this framework between providing the right and appropriate levels of security based upon risk across the chemical sector; and at the same time maintaining the economic vitality of the chemical sector so that we don't inadvertently hand a victory to al Qaeda on the economic side of the house. We have to achieve this with this framework.

So this list of chemicals is a very important list, because it identifies those things which the Secretary of Homeland Security vis-à-vis his statutory authority considers high risk in nature, based upon specific threshold quantities for methods of packaging in the industrial processes through which they are used, stored, distributed across the nation.

So this is the first step in a framework now that again is very complex, but it's important, because now we've defined the universe of people that will now submit to the second step of the process. The second step of the process is determining very objectively work-type of consequences, the users, the stores, the distributors, the manufacturers of these chemicals of concern associated with certain quantities identified in this Appendix.

What human life, public health and safety, economic consequences do they in fact represent to the nation. And that is the next step of the process, so this is kind of a continuous system of filters. The Appendix A itself is the first filter. The next step will be an automated, user friendly turbo-tax type of program that the facilities that have these chemicals of concern at the designated threshold quantities will now reach out and touch.

They have 60 days from the publication of this Appendix in the Federal Register, which will occur to my understanding in about two weeks. That's about a two-week process to get the document in the Federal Register. At this point, however, as of today it is going onto the DHS website and every chemical company in the world can take a look at it and see right now, because it's going to apply to them and they can make a decision whether or not to get started in advance of the publication of the document itself through the Federal Register process.

Following that 60-day period, we will then conduct a consequence analysis of the chemical sector based upon this appendix across the United States of America and determine a preliminary consequence ranking of the chemical sector of the United States of America. Based upon this preliminary consequence hearing, we entered the third step of the process, which those facilities that are determined to be of a sufficient risk level.

And they will be shredded out into four preliminary tiers. They will be asked to conduct a very comprehensive, on-line, and protected vulnerability assessment, which will help us characterize the vulnerabilities associated with their individual facilities. They have 90 days to complete that process from the time we give them the green light. And then we use the combined results of the step 2, which is the consequence assessment, and step 3, the vulnerabilities assessment to determine a finalized tier ranking and determine those facilities exactly to the facility that the Secretary determines to be of high risk.

They will be shredded across four tiers, and they will have to build security plans that we approve. And the level of stringency of those security plans against 19 performance-based standards, of course, will vary, depending on where they fall out in terms of risk ranking. And then we have the process from time immemorial to conduct audits and inspections according to a certain frequency of those facilities measuring up to what we have agreed to with them, represents appropriate measures by risk here for their facility. And so this is where we are in this gigantic process.

A huge intellectual exercise, because what this framework represents in terms of this Appendix A are three threat vectors that don't exist ballistically in any other framework currently. And, like I said, this is a new deal. We're looking at taking off the table high risk facilities that represent an off-site release hazard: toxic bi-inhalation release, toxic vapor clouds, flammables and explosives that could kill a lot of people.

That's the first area of concern or threat vector. The second threat vector is those chemicals that represent a theft or diversion threat. That is, if these chemicals were stolen from a facility, they could be taken somewhere else, weaponized, and then used somewhere else to kill people. An example would be what we see in fact happening with chlorine in Iraq. What we saw happening with propane and the one in Glasgow are flawed attempts to kill people by taking chemicals off-site, weaponizing them in an IED configuration and using them somewhere else.

And then the third threat vector is a sabotage and contamination threat vector. That is, taking the chemicals off-site, putting them into a water supply, putting them into the environment somehow, and again affecting public health and safety in causing loss of human life. To get to this Appendix A wasn't an easy thing. In fact, nothing that I do actually is an easy thing. Everything is very complex. Everything is very tough and everything involves a huge amount of collaboration.

We used wherever we could, existing lists of hazardous substances and chemicals identified by someone else. For example, we drew heavily upon the environmental protection agencies, risk management database, toxic by inhalation chemicals, as they define it. We took a look at working with the Department of Transportation or transportation hazmat or hazardous materials as they are defined under that framework.

We looked at collaborating with the Department of Commerce and drew heavily upon their chemical weapons convention, identification of chemicals that could be used as direct chemical weapons against human populations. We tried where we could to use or leverage an existing list that's already been scientifically proven, tested, and litigated against. So that we wouldn't have to repeat on any lessons learned through somebody else's process, we wanted to already start from a higher elevated baseline.

In addition, there were no good answers in terms of existing lists or frameworks. We consulted heavily with the FBI's explosives unit, chemical-by-chemical in fact to get a thumbs-up or to get their opinion. We also consulted heavily with our science and technology directorates, Chemical Security Analysis Center up in Baltimore.

And through them, literally dozens and dozens of other members of the scientific and academic communities around the country, homeland security centers of excellence, the National Laboratory complex, just lots of experts to get more eyes on this prize to make sure we got it right.

All of that process took about six months from the date of publication of the interim final rule back in April to where we are now. When we published the Interim Final Rule in April, this was the one piece of the Interim Final Rule that wasn't actually final in our eyes, so we left it open for a 30-day public comment period. At the end of the 30-day comment period, we collected everything we got through the Federal Register process, and it turned out to be about 4,300 comments from around the country.

About 4,000 of those comments came from the propane industry, and then 300 comments from everybody else that decided that they wanted to have an impact on this framework. So as a result of those comments we held additional listening sessions, either collectively with elements of the chemical sector, and/or with individual commentors where we needed additional clarification on what they were actually trying to say in the written comments. Examples are the public health community, colleges and universities, the propane industry, agricultural users of certain chemicals that were in the draft Appendix A.

So we conducted numerous listening sessions as permitted by law to figure out exactly what the operating landscape of some of these chemicals of concern might be where we didn't have a good picture initially, and we used the public comment period. We used the listening sessions. We used the academic experts. We used the explosives unit, FBI experts.

We used the National Lab experts to walk through, chemical-by-chemical to make sure we absolutely had it right, and there would be no better list of substance of the concern and no better threshold quantities. And, as you will see if you do a comparison, which I'm sure you will, between what we propose as a draft Appendix A and what we have now, there's been a considerable amount of change based upon all those various sources of input.

One source of input that was also out there was a lobbying campaign which, of course, I do not expect it was by lobbyists. I expect inputs through the Federal Register process; and none of this framework was conditioned by anything that I heard from any lobbying organization or lobbying or interest group, strictly through the Federal Register process or Chemical Sector Coordinating Council under the National Infrastructure Protection Plan, the labs, all those other folks that I just discussed.

I think we now have the best possible list that we could have at this time. I also want to stress that since this thing is completely new and highly complex, the regulation itself is flexible enough that over time, if there are certain aspects of this that we have not yet gotten right -- if there's an additional chemical out there that somehow the net has missed -- if we've gotten the threshold quantity, not exactly the way it needs to be -- if we've gotten a packaging piece not exactly the way it needs to be -- we have the opportunity to go back through the rulemaking process and make adjustments to Appendix A, using that rulemaking process to do so.

And I think that's a very good thing, because what that says is Congress has recognized, the department has recognized, that this is a tough nut to crack -- lots of complexities -- lots of things change over time. Our terrorist adversaries, in fact, are very dynamic in nature and they seem to use an ever increasing amount of things in their disposal and figure out very creative ways to weaponize them and make them explode and kill people.

And as we analyze our adversary over time, there may be additional things that may have to come inside this framework at a certain threshold quantity to be established again through that rulemaking process.

None of this is arbitrary and capricious. It's based upon as exact science and technology that we have at our disposal at this point in time and, again, with the flexibility to continuously improve upon it. Another factor to consider is if you shred out as a facility that meets the criteria in Appendix A, you hold a chemical of concern of a certain threshold quantity in a certain packaging configuration.

That doesn't mean you're going to make it through the next three filters in the process. It means you're a candidate for regulatory scrutiny for security purposes, and now you pass to step 2 again, which is the consequence assessment or consequence screening process.

So, ladies and gentlemen, this has been a heck of a tough thing to get assembled. We tried our best to reach out across the country and make sure we got the right inputs through the appropriate channels and processes that we're going to do the right thing here, according to the statutory requirements that we have to meet.

We're going to help the Secretary define this regulatory universe, and now the challenge for my team and I is to execute this thing, to implement it in as timely a manner as possible so that we can take this sector off the table vis-à-vis terrorist attack.

So at this point, I'll open it up to any questions you might have, and I'll also introduce Maribeth Kelliher. She's an angel of mercy, like Joan of Ark in this process, because she is an expert on every single one of these chemicals and has poured an incredible amount of life or pro life into this process over the last six months, just on Appendix A alone, and from A to Z as a master of the facts on why each chemical's on this list and why we reach certain packaging decisions and why we reach certain threshold quantities.

All of this information is available of course in the Appendix A, itself, because in addition to the tables of matrixes you will see there's a very detailed, technical explanation for why each chemical is on that list and balancing that off against the prescribed threshold quantity so that there would be no shadow of doubt in anybody's mind.

So folks?

Question: My question would be how does DHS plan to insure that, you know, all companies or parties that possess the specified amount of chemicals initially first fill up that top screen and then, you know, follow the steps after that to mean, you know, they meet the next criteria.

I mean, are there going to be enforcement?

Are there going to be fines?

And what if there was a situation where if there was a fine, it made more sense economically for a company to pay the fine than to go forward with the security that he might recommend.

Mr. Stephan: Sure -- a couple, three different answers to that. We're going to get the word out in various ways. We're going to use the Federal Register process. We're going to use the Chemical Sector Coordinating Council, which has basically has representatives from all the major associations, major corporations, medium-sized corporations, small corporations. We're going to use state and local Homeland Security advisors to push the word out; and, we've actually been working in coordination with them very intensely over the past six months to develop our chemical vulnerability information protocols that will allow and facilitate protected information sharing between us, the facility, state and local law enforcement and first responders.

So, we're going to use them as well. We're going to use state associations. We're going to use EPA, the Department of Commerce, the Department of Agriculture, the Department of Education, all of our federal family to help us get the word out. And there's going to be, last but not least, a lot of peer pressure within industry that's going to be a self-policing kind of a function that I think can pay for. It's going to come to me naturally, because if somebody isn't doing it and another company finds out about it, I think I'll probably find out about it somehow.

There are fines. There are fines and penalties throughout this process. If companies do not submit to the top screen process and they meet the criteria of Appendix A, we automatically presume that they are high risk and we will treat them as so, which means if they do not follow the guidance provided in the regulation, they are subject to a warning shot across the bow from me as a first step. They are subject to a $25,000 a day fine. And, they are subject to an order to cease operations, shut down the facility until they're in compliance.

So there's a stick, ladies and gentleman, in terms of enforcing this regulation from the GECO. Not just the final inspection piece, but every step of the way if people are not in compliance with the top screen and vulnerability assessment, the security planned, designed and build process, those penalties kick in.

Question: Can you tell me what the principal difference is between the proposed list and the final list published today? For example, I understand that Acetone and Urea were removed from the list in its final form. Anything else that you can specify?

Mr. Stephan: Well, I think part of the biggest single change is that in the draft Appendix A, there were a lot of chemicals. When you looked at the threshold quantities, it said any amount. And that was a place-holder to be quite honest with you, to allow further collaboration and dialog with various partners inside the chemical sector or users of various chemicals or holders of various chemicals of concern.

So you will see across the board there is not a single item now where we have in any amount. There's been a very scientifically, technically determined factor figure against or across every one of the chemicals. Some chemicals have fallen off the list, principally because we found out that individually some of these chemicals don't really represent a threat. When mixed with something else is when they take on the nature of a threat, and there are a couple of specific examples that you mentioned of chemicals that have fallen into that category.

So the idea was to regulate the piece of the puzzle that they can be hooked to that would cause them to be a threat, instead of, for example, trying to regulate hydrogen peroxide across the universe of hydrogen peroxide. Let's tie it to something that actually makes it weaponizable. The same way my decision was made with respect to Urea.

Other changes are that in certain sectors, for example, agriculture, the 7500-pound limit or threshold quantity for propane was our initial judgment based upon some very, very preliminary interaction with the agriculture sector; and specifically the propane industry follow on listening sessions with the propane industry – owners and operators, farmers, agricultural constituents. Those gave us a better understanding of what the operational nature of propane is in, for example, the Chechen community, inside the Turkey community, inside the agricultural community at large, help us to understand better how propane was packaged for shipment and what that means and in what kind of quantities we could expect to see with respect to storage.

And that helped shape the final numbers that you see; and, in fact, they're quite elevated -- 60,000 by 7,500. And what that does is get you major commercial users, distributors, manufacturers, as opposed to individual farmers, households that use propane for heat.

Question: So is hydrogen peroxide off the list?

Mr. Stephan: No. Hydrogen peroxide is on the list in a certain percentage, and I believe it's 35%. But again, we tried to narrow it down so it really had to represent a more significant rest than just in, you know, for example let's go back to the propane piece.

How many of you here own your own individual barbecue tank in the back yard? Probably not. It's probably not achievable. Every Seven Eleven in America sells 25-pound barbecue tanks full of propane. That's an unachievable objective.

But, what we can do, is if I can draw your attention to a safety-related incident in Dallas a couple months ago where a propane factory exploded and caused significant disruption in downtown Dallas. And we had a recent similar occurrence of that in the Pacific Northwest. Imagine if you will, ladies and gentlemen, a concerted campaign of terrorist attacks against such facilities where we could have significant populations around these plants. That's what we want to take off the table.

I don't want to take away your ability to barbecue a steak on the weekend. I want to take away the ability of a terrorist to use a facility that's in a populated area as a weapon against that population.

Anyone else?

Question: I got a couple. Written within the comments on Appendix A you make the point that you're going to be overlapping with a number of other areas in DHS, for example, with the Coast Guard and MTSA. I would imagine with Customs and Border Protection on imports and TSA on inland transportation.

So just in operational terms, you know, how are you going to divide the jurisdiction?

Mr. Stephan: Sure. Well, Congress has helped us make that division of labor in some cases, and then the Secretary of Homeland Security will actually, since he's the boss of all the organizations that work for him, of course, he will help set the tone for the rest of it.

In terms of MTSA, our statute that gives us our authority, specifically exempts MTSA-regulated facilities from our framework. So those will remain under the jurisdiction of the U.S. Coats Guard. The Transportation Security Administration has jurisdiction over the transportation aspects of hazardous material shipments.

What we need to do is under the Secretary's leadership and direction work collaboratively with the Coast Guard, with TSA, and with my shop, the Office of Infrastructure Protection, to make sure that between those different spheres or different dimensions of hazardous materials and different pieces of legislative authority and rules and regulations that there are no seams between those rules and regulations that could be exploited by a terrorist adversary.

For example, if we're talking about the Dow or DuPont Chemical facility, that means our high risk criteria, this regulation that I'm responsible for is going to cover everything inside the fence line. Now, of course, things leave the fence line and enter the fence line through a transportation grid, either by road or by rail. TSA has a responsibility and they have a final rule in the works as you should all know at this point that governs how that process is going to work. And we have a working group between us, TSA and the Coast Guard to make sure that at the scene, which is that fence line, that all of these different regulatory structures all come together.

Question: So, in other words, there is a bulk transfer facility for large tanks to a retail delivery truck, the facility might be under your purview, and the truck's going to be under TSA?

Mr. Stephan: No. Once it's inside the facility, it's mine. But getting to the fence line and leaving the fence line to go out is TSA.

Question: Well, no. I was talking about say, you've got a rural propane facility that excesses the threshold amount for, you know, propane. And a bobtail truck is going to pull up and load that truck up. So is that facility under your jurisdiction?

Mr. Stephan: The facility itself is under our jurisdiction. And a transportation vessel that's on the facility or conveyance that's on the facility is under our jurisdiction when it's on the facility. But that doesn't mean that Bob is setting the conditions and standards completely in non-collaboration of TSA.

Bob and his guys are working with TSA to make sure that hey: if rail is coming in the facility, if trucks are coming in the facility, we have to work together to make sure that there's not a dramatic difference as we cross a fence line, which is a boundary that only we recognize. Our terrorist adversaries, of course, don't recognize the fence line except as a potential opportunity to exploit. That's where we work together.

And the good news is that all of us work for one boss who is going to be ultimately responsible for making sure that these things are all harmonized.

Question: Well, that was my second question is who's going to enforce this. You know, we've just talked about agency, the front line enforcement authority, but also just the checking. You know, once facilities get their security plans approved, you know, is it going to be your office that's going to go out and give them the final say so? And, if they're wrong, is it going to be your office that brings the hammer down?

Mr. Stephan: That's correct. I have the enforcement responsibility with this regulatory authority. So I have now an initial cadre of inspectors that have been trained, familiarized with the chemical sector, operating plants throughout the chemical sector over the last six months, gotten them all kinds of technical certifications.

They've begun work with owners and operators, even before Appendix A has been put into place. They've begun work with the law enforcement, state and local authorities around the plant. In fact, you should all know this. I didn't have to wait for Appendix A to be finalized and pushed out the door before I could start, basically enforcing the regulation. The rule itself gives me two ways that I can bring people into this framework.

The first way is the one I just briefed to you all. You know, a series of different stages in a very complex process. However, the regulation also gives me the latitude to basically determine if I consider a facility to be potentially of high risk now without this process going one minute further in time.

I can direct them by letter to begin the top screen process. I have done so over the past several months with approximately 90 facilities; and, these 90 facilities have either completed or are very close to completing the top screen itself and have had initial set of multiple interactions with my inspector cadre, as well as with state and local law enforcement and other regulatory agencies if they exist in some of the states where these chemical facilities can be found.

So that process is already underway, and in fact I'm also using lessons learned from that initial set of 90 facilities that I'm going to export to the rest of this effort. Because now with this Appendix A piece, it's going to be a massive enrollment inside the top screen process with a massive amount of on-the-ground activities to take place. What we've already done will condition or help condition and approve that subsequent, larger-scale interaction.

In addition to that, I want to say that approximately without me telling them to do so, around 1100 companies have already enrolled in the top screen process, and about 150 or so have completed it; and I'm working with those people as well. So I've already got a head start in this program without waiting for Appendix A to kick in. And now I'm going to get the mass wave.

Question: How many did you say have completed top screen?

Mr. Stephan: I've got about 150 or so facilities that have already completed the top screen, really without me directing them to do so. And then I've got another batch of about 90 that I have directed to do so, and they've either completed or will shortly within the next 30 days or so complete it. So I've a good tranche of initial facilities to work with, either because I directed them to begin the process, or they voluntarily decided to get ahead of the bow wave and do it themselves. And we have not had an issue with any of the facilities up to this point in beginning this implementation.

Question: I was wondering how many are you expecting. Do you have initial estimates of how many people are going to assist you in top screening, or you are expecting to?

Mr. Stephan: I think the assumption that we're under right now is around 50,000 facilities around the country will be enrolled in the top screen process and based upon the best information that we have at this point, the best modeling we've been able to muster at this point, around 5 to 8,000 facilities will shred out at the end of the top screen process as preliminary high risk facilities.

So we begin with a universe of 50,000, and very quickly work our way through based upon an algorithm that's consequences-based at the beginning to get us to probably 5 to 8,000 high risk facilities.

Question: So 150 down? No, excuse me, 50,000; 249 down, 449,870 to go?

Mr. Stephan: For?

Question: Top screen piece.

Mr. Stephan: Roughly speaking. But you have to understand too that there's this magic date called April 15th. I don't know how many million Americans, tens of million Americans have to file an income tax return by that date. We don't seem mostly to have a problem with that, and everything is very highly automated. This is not a manual process. This is a computerized process much like TurboTax. And the algorithm is built. And we're just ready, and the computer cranks the analysis. This is not Ouiji boards and human muscle doing this. This is a sophisticated, computerized operation.

So whether it's 5,000, 50,000, the computer gets the difference in nanoseconds in terms of processing all this stuff.

Ms. Kelliher:: You should know that there are over 10,000 facilities registered on the SESAT tool, ready and waiting with an account and a password to fill out the top screen.

Mr. Stephan: Now, without me directing them to do so, they've taken a responsible position. They've done this on their own because they know most likely they're going to fall out or shred out somewhere in the top tier. Or, alternatively, they're convinced they're not and they want to get into the process and help us understand that they're not going to be part of this regulated structure, because they do not represent a sufficient level of consequence at the end of the day.

Question: Will there be an ability to extend the 60-day period if there's a diverse facility like a college or university that may have a lot of these small amounts they need to inventory beforehand?

Mr. Stephan: Correct.

Question: And how did you accept some of the recommendations of colleges and universities?

Mr. Stephan: First of all, it's a case-by-case basis. If there's somebody that writes a letter to me asking for an extension and gives me solid justification, I will work that on a case-by-case basis.

But the colleges and universities, of course, there were probably a lot of them that were surprised that they were potentially high risk chemical facilities. But at the end of the day, the question that has to be answered: do you or don't you have these chemicals above these threshold quantities on your site; and, if so, what are you doing about it. That is the question that has to be asked.

Now, sitting down with these folks, listening sessions, listening to how their chemical labs are structured, what their accountability processes are, what their security pieces are. They were calmed down quite a bit, just by us reaching out to them and saying, "Come and explain your issues to us, your concerns, your problems, your current landscape. What is giving you concern?" And we did all that with the colleges and universities.

And at the end of the day, those that fall into this framework, and many of them will fall out of the framework because they simply won't represent a high enough level of consequence; those that do, their security plans of course are going to look a lot different than a security plan for a Dow Chemical manufacturer with a zillion-gallon tank of something on-site that would represent a risk to tens and tens of thousands of people in the surrounding community. Their security plan is going to be a little bit different, I would say; in fact, quite a lot different than a typical college chem-lab security plan. And once we explain to them that this isn’t a one-size fits all approach and that the security planning effort has to be tailored to the risk environment and the operating environment that the individual facility represents, everybody was calm at that point and ready to go to the next step of the process.

Sir?

Question: You mentioned in your introductory remarks that you've had a lot of attention from U.S. and international chemical companies. Given that this regulation applies to U.S.-sited facilities, what interest have you had from our international companies involved in this, if at all?

Mr. Stephan: There are companies here that they may have an operating location here, a production facility here, a storage facility here, and perhaps their parent headquarters is located outside the United States. That could be a known example of something where an international company that has an operating location here in the United States may be affected.

And the facility security parameters of the operating location that's here in the United States are going to have to meet the standards of this framework.

Question: But it's only the U.S. facility that has a reporting and compliance obligation. It doesn't extend beyond the borders of the United States.

Mr. Stephan: No, this authority does not pertain to facilities outside the United States and its territories.

Question: Just kind of going back to the question I initially asked. I mean, are you concerned though about having companies that underreport so they don't have to go through this process? I mean, is that a concern of DHS?

Mr. Stephan: I mean, I don't want to say it's a concern at this point, because to be honest with you, we're working with the chemical sector here now four and a half years in DHS. And there is a very solid partnership that's been established. The vast majority of folks that I'm aware of every day in the chemical sector have embraced this framework as the right way to do it.

They understand the situation in terms of the threat, the adversary, in terms of what they need to do about it. And I don't see massive people or massive amounts of people or enterprises trying to escape and evade this framework. I see massive amounts of people trying to cooperate with us. But I do understand that there may be those outliers that do attempt, because that's just human nature, ladies and gentleman, that may possibly attempt to escape and evade the framework.

As I said, I think there are checks and balances in place, and there's going to be a heck of a lot of peer pressure within industry. And I think there's going to be a lot of self-policing. You know, you're a company that's doing the right thing, and you're making the expenditures. You're submitting yourself to this regulation and your neighbor is not. And you know that guy represents the same level of risk. I cannot believe I will not find out about that somehow.

In addition to all the formal mechanisms that we've put in place to get the word out about hey, this is the deal. These are the requirements. If you meet this criteria, you need to do this step. You need to enter the first step of the process.

Question: And you said that your inspectors are going to be in charge of making sure that people are complying?

Mr. Stephan: Complying with the security plans that I've approved.

Question: Okay. That's what the compliance.

Mr. Stephan: They inspect to the security plans that are developed. Actually, they'll be jointly developed between the facility, us, the state and local law enforcement and emergency responders, but then finally approved by the Department of Homeland Security, approved by the Secretary with that authority delegated down to me. And so that's what they will inspect against.

Question: And how many inspectors did you say there were?

Mr. Stephan: Right now I have a cadre of about 40 inspectors that I've been able to basically purchase with '07 funding. It sure would be nice if Congress would pass an early budget so I could get my hands on some additional people that I've requested and additional resources to continue to implementing this program.

The ultimate number of inspectors will depend upon the exact number of facilities that's right out at the end of the framework. So I'm kind of building the inspector cadre as I go. And this framework will, of course, be implemented in phases. And I'm really focusing on the things that will end up as initial tier 1 and 2 facilities as, you know, the first year to 18 months of this program focus. I absolutely want to take those off the table and focus all of my initial resources on them.

And then as we get more resources pushed to us, hopefully in the '08 and '09 budget and beyond, well then this program becomes in place at full strength.

Question: And one more follow-up question.

With the $25,000 that you mentioned per day fine, is that for each of the steps or is that just for not submitting to the top screen in time?

Mr. Stephan: That's for violating any aspect of the regulation that's in place during any phase of its implementation.

Question: And then what, could you shut down the facility?

Mr. Stephan: Yeah, and if you go back to the interim final rule, it gives a pretty carefully calibrated sequence of steps. The first is a warning shot across the bow. They're not in compliance with something I pushed on the letter. They have so many days to respond. There's an adjudication and appeals process with each step to make this all fair, above board, honest and equitable.

The second piece of it is, the $25,000 a day fine. There's a similar appeals and adjudication process there. And then finally there's the order to cease operations, if they're just in heinous violation with whatever aspect of the regulations in question.

Question: I have a couple questions so I better understand this.

Compared to taxes, so let's say, I'm one of the 50,000 facilities that will be screened, and once I get top screen, how long and how difficult is this process? It takes the property business a while to do their taxes.

Mr. Stephan: Okay. It depends on what kind of chemicals you have on site, how they're stored, how complex your business is. If you're somebody that has a single, 20,000 gallon propane tank, it's not going to take you very long to walk through the TurboTax equivalent, which is the top screen, because most of the things are going to be not applicable, not applicable, not applicable. And you're just going to continue to scroll down.

Now, if you're a DuPont or a Dow that has multiple chemicals that you're producing, multiple chemicals that you're using to produce the other chemicals, then you've got a very complex set of things that you're dealing with across the various threat dimensions that we discussed earlier, then it could take you a rather significant amount of time.

Then that kind of company is going to have the staff on board. They're going to have the people on board, because they will have had to comply with huge safety regulatory requirements on the EPA side of the house. So again, I think the lift is going to be correspondingly heavy or light depending on how many chemicals, what kind, how they're distributed on your facility, and so on and so forth.

Question: Well, I guess. Okay, so two questions on that then.

So if a small facility, relatively easy let's say, for taking a lot of NAs, are we talking two hours or are we talking two weeks?

Mr. Stephan: I'm talking 30 minutes. I mean, like I did it. I was chemical plant Bob. I had three chemicals on-site. I met the list. I sat down in front of the machine. I purposely told my guys not to make me smarter than this. Make me artificially dumb, so that I go in there, and I'm just going to walk through. And I'm not going to ask anybody else in America to do something I wouldn't do first. So I did it. And I had three chemicals and it took me 30 minutes. And at the end of the day it said, "We're so sorry, but sadly you do not fall inside a regulatory framework, but thank you for participating in Homeland Security."

Question: So you didn't have to fine yourself?

Mr. Stephan: No. I didn't have to fine myself. And I would not be able to go to, even probably day two in the finding structure. So I was very honest and forthright in the process.

Question: So have you received any feedback in the commentary that larger companies or smaller companies are going to need to hire new staff; and is there going to be a new 'comply with this regulation department' at every major facility across the country?

Mr. Stephan: Well, again, the regulation itself builds the flexibility in. Whereas, if somebody is legitimately walking through this process and their facility is highly complex in nature, they can always come to me and say, hey, this is what my landscape looks like, Bob. I need some more time. And I'm honestly making the effort. This is all forthright. Here's the justification. I'm going to consider that on a case-by-case basis.

But also, ladies and gentleman, realize that many of the people that are going to be principally affected by this have known about this for a long time. As Mary Beth indicated, 10,000 companies have already registered for the top screen piece and are somewhere in the process of completing it. We've got about 1,100 of those top screens in from those companies; and those are the ones that are doing this on their own, plus the 90 or so that I directed to do it.

Generally speaking, for the things we're most concerned about, this has not been happening in a vacuum. They know this is coming. They've been following closely the development of this Appendix. Those that really know they are going to fall inside this framework, because they're at the top of the EPA's hit parade. They're at the top of the Department of Commerce's hit parade. They're at the top of DOT's hit parade. They know it and they're rolling through the thing as we speak.

Now, it's the other segment, the people that this kind of catches them by surprise. But if they're being caught by surprise, it's because they probably do not have a very significant amount of chemicals and they're not a very complex enterprise. And if they have to fill out the top screen, I don't think it's going to be a very expensive or time consuming process.

Question: So, the propane especially industry didn't respond that, okay this means we'll have a full-time employee devoted to this project, or I've got new contractors coming in. No one complained that it was a huge expense?

Mr. Stephan: This lady has looked at every stinking comment I think that we received of the 4300.

Ms. Kelliher::: There were comments about the manpower and resources that might be required, but in many cases we've been drawing on existing federal programs. So in that sense, companies that are already regulated can use existing records in a different way to comply with our program.

But the function of the outreach that we've had thus far is to make contact with communities that may be surprised that chemicals they possess are on Appendix A and the colleges and universities is a good example of a community that we wanted to make aware of the risks around some of the products they use from legitimate research and development.

We hear there is a lot of collaboration within the community on how best to comply. And that's another way, I think, to get at the outliers who aren't aware of the program or who seek to circumvent it. There's a lot of collaboration in the different business segments that are affected.

Mr. Stephan: Within the propane world, there was a lot of commentary that individual farmers that maybe some don't even have access to the Internet, or don't even know that there is an Internet now. Or some of those guys out there would be really burdened by this. But if you really take a look at it, most of those people now are not going to meet the newly established threshold quantity for propane, for example, and are not going to be asked to do even the very first step in the process.

Ms. Kelliher:: And we did bring in small, medium and large companies to pilot each part of the tools. The top screen and the SDA were piloted by small, medium and large companies.

Mr. Stephan: Yes?

Question: Mr. Stephan, you described a four-step process: the top screen; the second phase of preliminary consequence ranking; and then the companies that are identified preliminarily as high risk have 90 days to do a vulnerability assessment; and then step four, a final tier ranking in the development of security plans.

Mr. Stephan: Correct.

Question: Do you have a rough idea of when you'll get to stage 4, the identification of the final, high risk, tier 1 and tier 2 companies, and then the security plan development will have to begin? Is that middle of next year, or '09?

Mr. Stephan: Well, let's just work through the timeline together. So there is an initial 60 days; and then about a month of analysis. So that's three months. And then they've got three months to do their vulnerability assessments. That's six months. Another, probably, two months to go through the vulnerability assessments. That's eight months. And then the plan development, I'd roughly say about a year from the time we go hot on the top screen, which again the trigger is the Federal Register notice of publication.

But the vast majority of the folks that are certainly going to be in the top ones, twos, threes and fours of our structure, and really the ones and twos, these are companies that have already been implementing security measures, specifically since September 11, that are greatly increased from what they were before September 11, 2001.

So it's not like everybody's security posture is on hold, or nobody is doing anything waiting for this scheme of maneuver to get put in place all across the country. And what we're doing is building additional security enhancements into a level of work that's already been done by industry and a level of work that's been done by us working with state and local law enforcements and putting individual grant monies to specifically identify chemical plants that before any of this happened we thought we kind of high risk in nature anyway.

So this is building like a third layer on top of voluntary efforts by industry itself. Our efforts with state and local governments to enhance their capacity outside the fence, now that it's final they're applying regulatory pieces of the puzzle on top of all that.

Ms. Kelliher: We have time for everyone to ask one more question.

Question: You've touched on this already a little bit, but there was a self-help program put together by the American Chemistry Council a couple of years ago. I think it was reasonable care, or something like that.

Mr. Stephan: Responsible care.

Question: Responsible care. Thank you.

Are companies going to be able to use what they've done so that they comply?

Mr. Stephan: Absolutely. Right. Now, there won't be a blanket acceptance of the responsible care code across the entire industry, but what we're able to do is if a company says an individual company comes to us, actually an individual facility comes to us and says under the responsible care code I've done the following things.

We will take a look at that and map them against what their performance-based standard requirements are depending on what tier they're in. And if there's a match, one for one, we'll give that approval as certifying the requirement. Or, it's 90% good to go, but these two performance standards are not met by this plan that you've been implementing now for three or four years.

You've got to work on those two or we'll add those to your existing plan. You'll be good to go. So we won't leverage work that has already been done by industry, because it would be very inefficient and costly to not do so.

Question: Good. Thank you so much.

Question: You mentioned the 19 performance-based standards that are going to vary from tier-to-tier. Are those standards going to be public information, or is that something that's going to remain confidential in the operation of the program?

Mr. Stephan: The 19 performance-based standards are identified in the interim final rule, so they're publicly available right now. How the individual facilities meet those performance-based standards will be sensitive information that will not be publicly available, of course.

Question: And one last thing. If Congress moves, and as they must rewrite this law before the end of '09, before it's sunset.

Mr. Stephan: I would not say that I would prefer they rewrite the law. I would simply say that the provision that sunsets it in '09 is done away with. We don't want this law to be rewritten. Let us modify the regulation as appropriate based upon what we find out as we evolve this thing over time.

But going back to square zero with a rewritten statute would be not a good plan -- very wasteful, very inefficient -- and would actually hinder our ability to put security measures in place, verify that they're replaced and report upon them if we're continually changing every three years the statutory framework upon which this is all based.

Ms. Kelliher: Any other questions?

Question: Could I just ask you one more question along the same line they've been asking?

Is there any scenario where it would be particularly like a small company where it might be economically sensible for them to try and avoid the regulation as opposed to like paying to like have somebody do the top screen or any security measures that they might have to implement on the road? Is there anything that you could say?

Mr. Stephan: Well, as long as they can survive me ultimately shutting down their facility, well, forever, I guess, that would be the only circumstance I can envision. Now, the first concern is just making sure everybody's aware of these new requirements and we're doing that with multiple, overlapping, intersecting mechanisms and venues by channels of communication.

And then again, if we find out, and we will through various means, that somebody is not in compliance, we're going to have a discussion with them to offer them the opportunity to get in compliance. And then they're going to get a written letter. And then they're going to get a fine; and then they're going to get shut down.

###

This page was last modified on November 5, 2007