H.R. 2868 amends the authority of the Department of Homeland Security (DHS) and the Environmental Protection Agency (EPA) to protect against acts of terrorism against chemical facilities, wastewater treatment works, and drinking water systems. The bill also makes DHS' Chemical Facility Anti-Terrorism Standards permanent (see Background section below).
The bill authorizes a total of $900 million over three years for chemical security, including $325 million in Fiscal Year 2011, of which $100 million would be available for methods to reduce the consequences of a terrorist attack, $300 million in Fiscal Year 2012, of which $75 million would be available for methods to reduce the consequences of a terrorist attack, and $275 million in Fiscal Year 2013, of which $50 million would be available for methods to reduce the consequences of a terrorist attack.
Risk-Based Designation and Ranking of Chemical Facilities: H.R. 2868 authorizes DHS to designate any chemical substance as a "substance of concern" and establish threshold quantities for each such chemical that is used, stored, manufactured, processed, or distributed by a chemical facility. Considerations would include the potential for death, serious adverse effects to human health, the environment, critical infrastructure, national security, or the national economy from a terrorist incident.
The bill requires DHS to maintain a list of facilities that have more than a threshold quantity of a "substance of concern" and pose a security risk based on criteria such as the potential threat or likelihood of a terrorist attack at the facility, the potential harm from a terrorist incident, and the proximity of the facility to large population centers. DHS could require a facility to submit information regarding the facility's substances of concern to determine whether it would be covered under the list.
H.R. 2868 also requires DHS to assign each covered facility to one of at least four risk-based tiers, with Tier 1 being the highest-risk. DHS would periodically review the list of substances of concern and the threshold quantities, and could at any time add, remove, or change the tier assignment for each facility. DHS would be responsible for providing covered facilities with relevant information about probable threats.
Security Vulnerability Assessments & Site Security Plans: H.R. 2868 requires DHS to establish risk-based, performance-based standards, and procedures for mandatory security vulnerability assessments and site security plans, and to set deadlines by tier for completion. DHS would approve or disapprove the assessments and security plans within 180 days of receipt. The bill directs facilities to review and resubmit their security vulnerability assessments and site security plans every five years. Facilities would have to notify DHS if they change their use or storage of a substance of concern or modify operations.
Site Inspections: The bill allows DHS a right of entry at reasonable times to chemical facilities to conduct security verifications and inspections. For Tier 1 and Tier 2 facilities, DHS would also conduct unannounced inspections to evaluate compliance with requirements of the bill. H.R. 2868 requires DHS to increase its number of chemical facility inspectors by at least 100 in Fiscal Years 2011 and 2012. During inspections, DHS would be required to offer employees the opportunity to share information about the facility's compliance or non-compliance.
Records: The bill allows DHS to require the submission of, or access to, a chemical facility's records in order to review its security vulnerability assessment or site security plan.
Information Sharing: H.R. 2868 requires DHS to provide information concerning a threat that is relevant to a specific chemical facility in a timely manner. Likewise, facilities would be required to report any threat, significant security incident, or penetration of the facility's cyber or physical security to DHS.
Enforcement: For owners or operators of facilities deemed to be in violation of the bill, H.R. 2868 allows the Secretary to issue a fine of $25,000 per day. The Secretary may also issue an order to cease operations at the facility until compliance is achieved to the satisfaction of DHS.
Whistleblower Protections: The bill directs DHS to establish a process for any person to report deficiencies or vulnerabilities at a chemical facility. The identity of the person would be kept confidential and retaliation against whistleblowers would be prohibited. Any employee who alleges retaliation occurred could seek review in district court.
Lack of Federal Preemption: The bill allows any State or local government to issue a regulation, requirement, or standard or performance for chemical facility security that is more stringent than the federal statute.
Information Protection: H.R. 2868 gives DHS authority to promulgate regulations and issue orders to prohibit the unauthorized disclosure of protected information. DHS would provide standards for the appropriate sharing of protected information with federal, State, local, and tribal governments, law enforcement and first responders, and designated chemical facility personnel. Any person who discloses protected information in knowing violation would be subject to criminal penalties and removal from federal office or employment. The legislation defines protected information to include vulnerability assessments and site security plans and portions of other security-related documents, and records that would be detrimental to the security of covered chemical facilities if disclosed. The bill does not prohibit the sharing of information with Members of Congress.
Methods to Reduce Consequences of an Attack: The bill requires the owner or operator of a covered chemical facility to include in its site security plan an assessment of methods to reduce the consequences of a terrorist attack (more commonly referred to as "Inherently Safer Technologies." The Director of a new Office of Chemical Facility Security could require a facility to implement methods to reduce consequences of a terrorist attack, if the director determines that certain conditions are met. An owner or operator of a facility could provide a written appeal to DHS, within 120 days, explaining why it cannot comply with the determination.
Background Checks: The bill requires DHS to issue regulations requiring chemical facilities to establish personnel background checks for individuals with access to restricted areas of the facility's critical assets. The regulations would describe the appropriate scope and applications for security background checks. If, as the result of a background check, a chemical facility finds that an individual is not legally authorized to work in the U.S., or meets certain criminal history disqualifiers, the owner or operator shall cease to employ the individual, subject to redress processes available to the individual.
Citizen "Enforcement" and Petitions: The bill allows any person to bring a civil action in district court against any governmental entity allegedly in violation of the Act or against the Secretary for an alleged failure to perform any act or duty under the bill.
The bill also requires DHS to establish a petition process to receive, investigate, and respond to allegations of violations at covered facilities. DHS would establish the parameters of the petition process and the procedures for the Inspector General's review of DHS' response to a petition. DHS would be required to accept all petitions, investigate all allegations, determine whether an enforcement action is required, and respond to all accepted petitions in writing.
Drinking Water Security: H.R. 2868 authorizes the EPA to regulate the security of community water systems serving more than 3,300 people, as well as other public water systems that EPA determines present a security risk. The bill authorizes $315 million in Fiscal Year 2011 for grants to States and nonprofits to help develop security plans for covered public water systems. $30 million of this total could be used for administrative costs incurred by the EPA or States, and $125 million could be used to implement methods to reduce the consequences of a chemical release from an intentional act at water systems. The measure authorizes such sums that may be necessary in Fiscal Years 2012 through 2015.
The bill requires water systems to conduct a vulnerability assessment, develop and implement a site security plan, and develop an emergency response plan. EPA would establish deadlines for these plans and for providing training to employees of water systems, and requires the EPA to consult with States exercising primary enforcement responsibility for public water systems and with DHS. H.R. 2868 requires EPA to assign each water system to one of four risk-based tiers, with Tier 1 being highest-risk. It requires the EPA to develop regulations to establish risk-based, performance-based standards and procedures for mandatory security vulnerability assessments and site security plans. The bill allows each water system to select layered security measures that address the security risks identified in the vulnerability assessment and meet the risk-based performance standards.
Under this bill, EPA would provide guidance, computer software, and other tools to water systems in Tier 3 and Tier 4 to streamline the process for other systems. For a water system that is assigned to Tiers 1 and 2 that possesses a substance of concern, the State exercising primary enforcement for the system would be required to make determinations on methods to reduce consequences of a chemical release. In States without primacy, the EPA would make such a determination.
The State with primacy could require a water system to implement methods to reduce consequences of a chemical release if it determines that certain conditions are met. Such conditions include whether consequence-reduction methods would significantly reduce the consequences of a release of a substance, not increase the interim storage of a substance of concern by the water system, not put the water system out of compliance with the Safe Drinking Water Act, and remain feasible for the water system.
A water system that violates any requirement of this section would be liable for a civil penalty of up to $25,000 for each day after the violation occurs.
H.R. 2868 allows EPA to make grants to States, non-profit organizations, and water systems to assist them in implementing this section. The bill also creates a new worker training grants program for training and education of employees with roles or responsibilities under the bill.
Wastewater Treatment Works Security: The bill establishes EPA as the lead agency for wastewater security. It authorizes $1 billion over five years for EPA to make grants to States, municipalities, and other entities to conduct vulnerability assessments, providing security-related training to treatment works employees and emergency response providers, and install security improvements at publicly-owned wastewater treatment facilities.
The bill also requires treatment works with a capacity of at least 2.5 million gallons per day, or any facility deemed by the EPA to present a security risk, to conduct a vulnerability assessment, develop and implement a site security plan, and develop an emergency response plan for the treatment works. H.R. 2868 requires EPA to assign each covered treatment works to one of at least four risk-based tiers, with Tier 1 being highest-risk. It requires the EPA to develop regulations to establish risk-based, performance-based standards and procedures for mandatory security vulnerability assessments and site security plans.
The bill directs EPA to require the owner or operator of a covered treatment works that possesses a substance of concern to include in its site security plan an assessment of methods to reduce the consequences of a terrorist attack, including the elimination or reduction of such substances. The assessment would include the potential impact of the method on the responsibilities of the treatment works under the Clean Water Act. It would also provide for the mandatory implementation of a method to reduce the consequences of a terrorist attack for a treatment works that is assigned to the highest two risk-based tiers and possesses a substance of concern.
The bill requires the owner or operator of a treatment works to develop an emergency response plan that incorporates the results of the current vulnerability assessment and site security plan, and certify to the EPA when the plan has been completed.
