[Federal Register Volume 75, Number 70 (Tuesday, April 13, 2010)]
[Notices]
[Pages 18850-18857]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2010-8312]
=======================================================================
-----------------------------------------------------------------------
DEPARTMENT OF HOMELAND SECURITY
[Docket No. DHS-2009-0026]
National Protection and Programs Directorate; Chemical Facility
Anti-Terrorism Standards Personnel Surety Program
AGENCY: National Protection and Programs Directorate, DHS.
ACTION: 30-day notice and request for comments: New information
collection request 1670-NEW.
-----------------------------------------------------------------------
SUMMARY: The Department of Homeland Security (DHS), National Protection
and Programs Directorate (NPPD), Office of Infrastructure Protection
(IP), Infrastructure Security Compliance Division (ISCD) will be
submitting the following information collection request (ICR) to the
Office of Management and Budget (OMB) for review and clearance in
accordance with the Paperwork Reduction Act of 1995 (PRA). The
information collection is a new information collection. A 60-day public
notice for comments was previously published in the Federal Register on
June 10, 2009, at 74 FR 27555. Comments were received and responses are
in this notice. The purpose of this notice is to solicit additional
comments during a 30-day public comment period prior to the submission
of this collection to OMB. The submission describes the nature of the
information collection, the categories of respondents, the estimated
burden, and cost.
DATES: Comments are encouraged and will be accepted until May 13, 2010.
This process is conducted in accordance with 5 CFR 1320.8.
ADDRESSES: Interested persons are invited to submit comments on the
proposed information collection through the Federal Rulemaking Portal
at http://www.regulations.gov. Follow the instructions for submitting
comments. Comments must be identified by docket number DHS-2009-0026.
Comments that include trade secrets, confidential commercial or
financial information, Chemical-terrorism Vulnerability Information
(CVI), Sensitive Security Information (SSI), or Protected Critical
Infrastructure Information (PCII) should not be submitted to the public
regulatory docket. Please submit such comments separately from other
comments in response to this notice. Comments containing trade secrets,
confidential commercial or financial information, CVI, SSI, or PCII
should be appropriately marked and submitted by mail to the DHS/NPPD/
IP/ISCD CFATS Program Manager at the Department of Homeland Security,
245 Murray Lane, SW., Mail Stop 0610, Arlington, VA 20528-0610.
Comments must be identified by docket number DHS-2009-0026.
FOR FURTHER INFORMATION CONTACT: A copy of this ICR, with applicable
supporting documentation, may be obtained through the Federal
Rulemaking Portal at http://www.regulations.gov.
SUPPLEMENTARY INFORMATION:
Program Description
The Chemical Facility Anti-Terrorism Standards (CFATS), 6 CFR part
27, require high-risk chemical facilities to submit information about
facility personnel and, as appropriate, unescorted visitors with access
to restricted areas or critical assets at those facilities. This
information will be vetted by the Federal Government against the
Terrorist Screening Database (TSDB), the consolidated and integrated
terrorist watchlist maintained by the Federal Government, to identify
known or suspected terrorists (i.e., individuals with terrorist ties).
[[Page 18851]]
High-risk chemical facilities must also perform other relevant
background checks in compliance with CFATS Personnel Surety Risk-Based
Performance Standard 12 (RBPS-12). See 6 CFR 27.230(a)(12)(i-iii):
High-risk chemical facilities must ``perform appropriate background
checks * * * including (i) Measures designed to verify and validate
identity; (ii) Measures designed to check criminal history; [and] (iii)
Measures designed to verify and validate legal authorization to work.''
The CFATS Personnel Surety Program is not intended to halt, hinder, or
replace high-risk chemical facilities' performance of background checks
which are currently required for employment or access to secure areas
of those facilities.
Background
On October 4, 2006, the President signed the Department of Homeland
Security Appropriations Act of 2007 (the Act), Public Law 109-295.
Section 550 of the Act provides DHS with the authority to regulate the
security of high-risk chemical facilities.
Section 550 requires that DHS regulations establish CFATS RBPS.
RBPS-12 (6 CFR 27.230(a)(12)(iv)) requires that regulated chemical
facilities implement ``measures designed to identify people with
terrorist ties.'' The ability to identify individuals with terrorist
ties requires the use of information held in Government-maintained
databases, which are unavailable to high-risk chemical facilities.
Therefore, DHS is implementing the CFATS Personnel Surety Program,
which will allow chemical facilities to comply with RBPS-12 by
implementing ``measures designed to identify people with terrorist
ties.''
Overview of CFATS Personnel Surety Process
The CFATS Personnel Surety Program will work with the DHS
Transportation Security Administration (TSA) to identify individuals
who have terrorist ties by comparing information submitted by each
high-risk chemical facility to the information of known or suspected
terrorists who are listed in the TSDB.
Information will be submitted to DHS through the Chemical Security
Assessment Tool (CSAT), the online data collection portal for CFATS.
The representative(s) of each high-risk chemical facility will submit
the information of affected individuals to DHS through CSAT. The
representative(s) of each high-risk chemical facility will also certify
that the information is (1) true, correct, and complete, and (2)
collected and submitted in compliance with the facility's Site Security
Plan (SSP). The representative(s) of each high-risk chemical facility
will also affirm that notice required by the Privacy Act of 1974, 5
U.S.C. 552a, has been given to affected individuals before their
information is submitted to DHS.
DHS will send a verification of submission to the representative(s)
of each high-risk chemical facility when a high-risk chemical facility
(1) Submits information about an affected individual for the first
time, (2) submits updated or corrected information about an affected
individual, and/or (3) notifies DHS that an affected individual no
longer has access to that facility's restricted areas or critical
assets.
Upon receipt of each affected individual's information in CSAT, DHS
will send a copy of the information to TSA. Within TSA, the Office of
Transportation Threat Assessment and Credentialing (TTAC) conducts
screening and vetting of information against the TSDB for many DHS
programs. On behalf of DHS, TTAC will compare the information of
affected individuals collected by DHS to the information of known or
suspected terrorists on the TSDB. TTAC will forward the results from
potential matches to the Federal Bureau of Investigation's Terrorist
Screening Center (TSC), which will make a final determination of
whether an individual is a match to a known or suspected terrorist
listed in the TSDB.
In the event that there is a positive match to an identity in the
TSDB, the TSC will notify the appropriate Federal law enforcement
agency for coordination, investigative action, and/or response, as
appropriate. DHS will neither routinely provide vetting results to
high-risk chemical facilities, nor will it provide results to an
affected individual whose information was submitted by a high-risk
chemical facility. As warranted, high-risk chemical facilities may be
contacted by the Department or Federal law enforcement as a part of
appropriate law enforcement investigation activity. (See the amendment
to the FBI's Terrorist Screening Records System, published in the
Federal Register on August 22, 2007, at 72 FR 47073.)
Information Collected
DHS may collect the following information from individuals:
Full name
Date of birth
Place of birth
Gender
Citizenship
Passport information
Visa information
Alien registration number
DHS Redress Number (if available)
Work phone number(s)
Work e-mail address(es)
DHS will collect information that identifies the high-risk chemical
facility or facilities, to which the affected individual has access to
restricted areas or critical assets. As applicable, DHS will also
collect information to verify that an affected individual is currently
enrolled in a DHS program which relies on DHS-performed TSDB checks, in
addition to other program-specific requirements.
DHS may request additional information on an affected individual to
confirm that the individual is or is not a match to a known or
suspected terrorist in the TSDB. DHS may randomly select a small
percentage of affected individuals for further verification as part of
data accuracy review and auditing processes. In order to assist with
this confirmation and verification, DHS may request additional
information on affected individuals from the high-risk chemical
facilities which have submitted their information to the Department.
DHS may also collect information about points of contact at each high-
risk chemical facility, and which points of contact the Department or
Federal law enforcement personnel may contact with follow-up questions.
However, a request for additional information from DHS does not imply,
and should not be construed to indicate, that an individual is known or
suspected to be associated with terrorism.
DHS may collect information on affected individuals as necessary to
enable it to provide redress for individuals who believe that they have
been improperly impacted by the Personnel Surety Program. The
information collected may include information necessary to conduct
adjudications under subpart C of CFATS, 6 CFR 27.300-27.345.
DHS will also collect administrative or programmatic information
(e.g., affirmations or certifications of compliance, extension
requests, brief surveys for process improvement, etc.) necessary to
manage the CFATS Personnel Surety Program.
Affected Population
6 CFR 27.230(a)(12) requires facility personnel and, as
appropriate, unescorted visitors who have access to restricted areas or
critical assets to undergo background checks. This affected population
will include (1)
[[Page 18852]]
facility personnel (e.g., employees and contractors) who have access,
either unescorted or otherwise, to restricted areas or critical assets,
and (2) unescorted visitors who have access to restricted areas or
critical assets.
These background checks do not affect facility personnel who do not
have access to facilities' restricted areas or critical assets, nor do
they affect escorted visitors.
Linking Affected Individuals to Specific CFATS Covered Facilities
To comply with CFATS, high-risk chemical facilities are required to
identify who is an affected individual, and at which high-risk chemical
facility or facilities each affected individual has access to
restricted areas or critical assets. DHS intends to collect this
information through CSAT.
Personnel Surety Submission Schedule To Check for Terrorist Ties
DHS will establish a CFATS Personnel Surety Submission schedule for
high-risk chemical facilities when submitting information to DHS to
check for terrorist ties under 6 CFR 27.230(a)(12)(iv). The schedule
will be published in the Federal Register. The schedule, when
published, will require: (1) An initial submission of information
either within a certain number of days after DHS issues a letter of
authorization or within certain number of days after publication of the
schedule, whichever is later; (2) additional submissions for
individuals that become newly affected (e.g., new hires or other
individuals given access to a restricted area or critical asset); (3)
updates or corrections to information for affected individuals whose
information has previously been submitted; and (4) notification when an
affected individual no longer has access to a restricted area or
critical asset. The schedule will likely vary by final tier. A proposed
schedule is provided in subpart (B) of the ``Response To Comments
Received During The 60-Day Comment Period'' section of this 30-Day
notice. High-risk chemical facilities may request extensions or
variances from this schedule based on unique or unusual circumstances.
Request for Exception to the Requirement Under 5 CFR 1320.8(b)(3)
DHS is requesting from OMB an exception for the CFATS Personnel
Surety Program to the Paperwork Reduction Act (PRA) requirement, as
contained in 5 CFR 1320.8(b)(3), which requires Federal agencies to
confirm that their information collections provide certain reasonable
notices, under the Paperwork Reduction Act, to affected individuals. If
this exception is granted, DHS will be relieved of the potential
obligation to require high-risk chemical facilities to collect
signatures or other positive affirmations of these notices from
affected individuals. Whether or not this exception is granted, DHS
will still require high-risk facilities to affirm that required Privacy
Act notice has been provided to affected individuals before personal
information is collected. See 5 U.S.C. 552a(e)(3).
DHS's request for an exception to the requirement under 5 CFR
1320.8(b)(3) would not exempt high-risk chemical facilities from having
to adhere to applicable Federal, State, local, or tribal laws, or to
regulations or policies pertaining to the privacy of facility personnel
and the privacy of unescorted visitors.
Responses to Comments Received During the 60-Day Comment Period
DHS received 17 comments in response to the 60-day notice for
comment. Comments were received from three private citizens, four
private sector companies, seven associations, one training council, and
one professional society. One additional comment was a jointly
submitted comment. Many of the comments were in response to the
questions posed by DHS in the 60-day notice for comments. In this
section of this notice, DHS first addresses specific questions that the
Department solicited, then other comments related to the Personnel
Surety Program, and finally unsolicited comments received in response
to the 60-day notice.
(A) On behalf of OMB, DHS solicited comments that evaluate whether
the proposed collection of information is necessary for the proper
performance of the functions of the agency, including whether the
information will have practical utility.
Comment: Commenters challenged the practical utility of requiring
high-risk chemical facilities to update previously submitted
information.
Response: The information collected by DHS is generally static.
However, DHS will require each high-risk chemical facility to update
and correct information previously submitted about affected
individuals. Updates and corrections do not necessarily need to be made
immediately when submitted information changes; rather, DHS will
require high-risk facilities to make updates and corrections in
accordance with a DHS-approved schedule.
For example, when a high-risk chemical facility becomes aware that
an affected individual's information has changed (e.g., when a high-
risk chemical facility becomes aware that an affected individual has
changed his/her name), the high-risk chemical facility must update the
submitted information. DHS will also require a high-risk chemical
facility to correct previously submitted information when the high-risk
chemical facility becomes aware that an affected individual's
information is incorrect (e.g., an affected individual's place or date
of birth). Requiring high-risk chemical facilities to update and
correct information about affected individuals will increase the
accuracy of the data collected, and decrease the probability of
incorrect matches to the information of known or suspected terrorists
listed on the TSDB.
One piece of information that may change is the list of high-risk
chemical facilities within one company or organization to which an
affected individual has access. When such a change occurs, updates are
not required immediately but rather in accordance with a schedule to be
published by DHS.
Comment: Commenters challenged the practical utility of requiring
high-risk chemical facilities to notify the Department when an affected
individual no longer has access to a high-risk chemical facility's
restricted area(s) or critical asset(s). Commenters suggested that this
notification by a high-risk chemical facility to DHS would provide no
value in the context of terrorism screening.
Response: DHS will not rely on a single, one-time check to
determine that an affected individual has ties to terrorism. Instead,
DHS will continue to vet an affected individual's information against
new and/or updated TSDB records as they become available, for as long
as the affected individual has access to a high-risk chemical
facility's restricted area(s) or critical asset(s). This process is
referred to as ``recurrent vetting'' and is a standard DHS vetting
practice. DHS will require high-risk chemical facilities to notify the
Department when an affected individual no longer has access to a high-
risk chemical facility's restricted areas or critical assets so that
the Department can cease recurrent vetting of the affected individual.
Comment: Many commenters suggested that the proposed collection of
information is needless and duplicative. Specifically, commenters
suggested that the proposed information collection will place an undue
burden on industry--in regard to time, money and other resources--by
creating a program which duplicates an existing DHS screening or
vetting program, such as the Transportation Worker
[[Page 18853]]
Identification Credential (TWIC) program.
Response: TWIC's authorizing statute, the Maritime Transportation
Security Act of 2002 (MTSA), as amended, 46 U.S.C. 70101 et seq.,
explicitly applies ``transportation security card'' requirements only
to: ``individual[s] allowed unescorted access to secure area[s]
designated in * * * [maritime] vessel or [maritime] facility security
plan[s]'' (Sec. 70105(b)(2)(A)); certain MTSA license and permit
holders (Sec. 70105(b)(2)(B)); maritime vessel pilots (Sec.
70105(b)(2)(C)); maritime towing vessel personnel (Sec.
70105(b)(2)(D)); individuals with access to certain protected maritime
security information (Sec. 70105(b)(2)(E)); and ``other individuals
engaged in port security activities'' (Sec. 70105(b)(2)(F)).
Furthermore, individuals are only eligible to receive TWICs if they
have not committed certain ``disqualifying criminal offense[s],'' or if
they do not meet certain ``immigration status requirements'' 49 CFR
1572.5(a)(1)-(2). However, the CFATS authorizing statute applies to
``chemical facilities that * * * present high levels of security risk''
Department of Homeland Security Appropriations Act of 2007, Public Law
109-295, section 550 (Oct. 4, 2006), as amended. CFATS Personnel Surety
Program requirements apply only to high-risk chemical facilities'
``personnel, and as appropriate * * * unescorted visitors with access
to restricted areas or critical assets'' 6 CFR 27.230(a)(12). Moreover,
facilities regulated under MTSA are exempt from CFATS. Accordingly, the
CFATS Personnel Surety Program is not duplicative of the TWIC program.
DHS recognizes that some affected individuals under CFATS possess
TWICs or other credentials that rely on DHS-conducted TSDB vetting
(e.g., an individual vetted under the TWIC program). DHS intends to
reduce the burden of this collection by recognizing previous TSDB
vetting results conducted by DHS. Therefore, an affected individual who
possesses a current and valid TWIC will likely require less information
to be submitted than an affected individual who does not have a TWIC.
Some additional personal information will be required in order to
verify that the affected individual has a previous TSDB vetting result
upon which the TWIC was issued.
Comment: One comment suggested that the vetting of affected
individuals against the TSDB has little practical utility in
identifying terrorists due to the large number of individuals whose
names appear on the TSDB, even though they are not actually threats to
national security.
Response: As indicated in the CFATS interim final rule, the
Department has determined that a TSDB check is necessary for the
purpose of protecting restricted areas and critical assets of high-risk
chemical facilities from persons who may have ties to terrorism. See 72
FR 17708. The TSDB is the Federal Government's integrated and
consolidated terrorist watchlist and is the appropriate database to
identify individuals with terrorist ties.
(B) On behalf of OMB, DHS solicited comments which evaluate the
accuracy of the Department's estimate of the burden of the proposed
collection of information, including the validity of the methodology
and assumptions used.
Comment: Commenters suggested that DHS did not provide sufficient
detail about the proposed information collection to adequately evaluate
the estimated burden.
Response: In order to provide the public with more information to
evaluate the estimated burden, the Department has established the
information submission schedule outlined below. The Department will
review comments received in response to this 30-day notice when
finalizing the DHS schedule for submitting information. High-risk
chemical facilities will be notified of the final DHS schedule prior to
its implementation. The final DHS schedule will also be published in
the Federal Register.
----------------------------------------------------------------------------------------------------------------
Final tier 1 Final tier 2 Final tier 3 Final tier 4
----------------------------------------------------------------------------------------------------------------
Initial Submission of Affected 60 days after DHS 60 days after DHS 90 days after DHS 90 days after DHS
Individual's Information. issues a letter issues a letter issues a letter issues a letter
of authorization. of authorization. of authorization. of authorization.
Submission of a New Affected Within 30 days of Within 30 days of Within 60 days of Within 60 days of
Individual's Information. being granted being granted being granted being granted
access. access. access. access.
Submission of Updates and Within 90 days of Within 90 days of Within 90 days of Within 90 days of
Corrections to an Affected becoming aware of becoming aware of becoming aware of becoming aware of
Individual's Information. the need for an the need for an the need for an the need for an
update or update or update or update or
correction. correction. correction. correction.
Submission of notification that Within 90 days of Within 90 days of Within 90 days of Within 90 days of
an affected individual no access being access being access being access being
longer has access. removed. removed. removed. removed.
----------------------------------------------------------------------------------------------------------------
Comment: Commenters generally believed the mechanics of the
information submission and update process could place a heavy burden on
high-risk facilities. One commenter indicated that DHS could expect
submissions to be in the tens of thousands per month. Commenters
suggested that the proposed 35-minute burden for the information
collection was based on an incomplete estimate, and did not account for
the duplicative submission of affected individuals' information by
multiple high-risk chemical facilities in the cases of individuals who
have access to restricted areas or critical assets at multiple
facilities.
Response: The estimated burden relied on the regulatory evaluation
published for CFATS on April 1, 2007. In the regulatory evaluation, the
Department estimated that 1,063,200 affected individuals would be
vetted against the TSDB (i.e., 29,533 per month) over a three-year
period. This estimate allows for the possibility that a specific
individual could have access at multiple high-risk chemical facilities.
The Department's population estimate also aligns with the commenters'
expectations that DHS should expect tens of thousands of submissions
during each month.
The estimated time for a responsible entity to submit the
information of each affected individual through the CSAT portal is 0.59
hours per individual. This estimate is based upon the CFATS regulatory
evaluation. The estimated time per affected individual was derived by
assuming that (1) 30 minutes is
[[Page 18854]]
required to type in the required information for every affected
individual once; (2) 5 percent of affected individuals will have some
element of their information change annually, requiring 10 additional
minutes of effort; and (3) 20 percent of affected individuals will lose
access to restricted areas or critical assets annually, which will
require 10 additional minutes of effort to remove each affected
individual's information from CSAT.
DHS believes that the information contained in this notice, in the
Personnel Surety Program's 60-day PRA notice preceding this notice (74
FR 27555 (June 10, 2009)), and in the CFATS regulatory evaluation
provides sufficient detail about the proposed Personnel Surety
Program's information collection process.
Comment: One commenter suggested that the Department's estimate of
the burden may not have accounted for the burden an affected individual
incurs from investigations and adverse employment decisions that may
result from the individual's possibly unjustified presence on the TSDB.
Response: The burden outlined in this 30-day notice is limited in
scope to those activities listed in 5 CFR 1320.3(b)(1). Specifically, 5
CFR 1320.3(b)(1) requires the Department to estimate the total time,
effort, or financial resources expended by persons to generate,
maintain, retain, or disclose or provide information to or for a
Federal agency.
The Department is also seeking to collect five core data elements
about each individual to be vetted under the Personnel Surety Program:
Full name, date of birth, place of birth, gender, and citizenship. When
taken together, these identifiers will minimize false positive matches
to the TSDB. Furthermore, each potential match will be manually
reviewed by Department adjudicators who have expertise in evaluating
matches prior to confirmation that an individual's information matches
the information of a known or suspected terrorist.
(C) On behalf of OMB, DHS solicited comments to enhance the
quality, utility, and clarity of the information to be collected.
Comment: Most of the commenters requested additional clarity about
what information DHS will routinely collect and update. Several
commenters suggested that the information collected should be limited
to information which is necessary to conduct an inquiry against the
TSDB. One commenter also suggested that the information should be
limited to personal information that is unlikely to change.
Response: As outlined earlier in this 30-day notice, DHS will
routinely collect an affected individual's full name, date of birth,
place of birth, gender, and citizenship. DHS will also collect
information that identifies the high-risk chemical facility or
facilities to which the affected individual has access. DHS has limited
the information routinely collected to include only that which is (1)
Necessary to conduct a TSDB check and adjudicate potential matches, (2)
unlikely to change, and (3) is essential for quickly understanding the
risk a known or suspected terrorist poses to high-risk chemical
facilities.
DHS will not require immediate reporting of updates to previously
submitted information. As previously discussed in this notice, DHS will
permit high-risk chemical facilities to update information on a
periodic basis in compliance with a DHS-approved schedule.
Comment: Most commenters commended DHS for intending to recognize
the previous TSDB vetting results completed by other DHS programs, such
as the TWIC program. Several commenters, however, suggested that DHS
should not collect information from high-risk chemical facilities for
the purpose of verifying the validity of credentials issued as part of
other DHS programs (which conduct TSDB vetting) because the burden of
data collection necessary to verify such credentials could be
burdensome.
Response: In lieu of conducting new TSDB vetting on all affected
individuals, DHS intends to recognize the results of previous TSDB
vetting conducted on individuals enrolled in certain other DHS
programs. Specifically, DHS is considering recognizing the previous
TSDB vetting results completed by other DHS programs, such as TWIC, and
the Trusted Traveler Programs (Secure Electronic Network for Travelers
Rapid Inspection (SENTRI), Free and Secure Trade (FAST), and NEXUS).
Further, DHS is also considering recognizing the results of TSDB
vetting (conducted by DHS) upon which each State relies when issuing a
Commercial Driver's License with a Hazardous Materials Endorsement
(HME).
This will likely require fewer pieces of information than are
required to vet an individual who is not enrolled in another vetting
program. DHS believes the burden of collecting those fewer pieces of
information is accounted for in the estimated burden.
This approach will also limit the number of instances in which
different DHS programs may vet the same affected individual against the
TSDB. If other programs' vetting results cannot be verified without
substantial effort, DHS may initiate new vetting of an affected
individual's information against the TSDB.
Comment: Several commenters recommended that the Department
recognize and offer reciprocity to the background checks, which include
vetting against the TSDB, as conducted by the Department of Justice
Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF). Commenters
suggested that without this accommodation, the regulatory overlap
between the two agencies will impose unreasonable burdens.
Response: ATF does not conduct recurrent vetting against the TSDB,
and thus is not appropriate as a reciprocal program to meet the
requirements of CFATS.
(D) On behalf of OMB, DHS solicited comments regarding the
minimization of the burden of information collection on those who are
to respond, including through the use of appropriate automated,
electronic, mechanical, or other technological collection techniques or
other forms of information technology (e.g., permitting electronic
submissions of responses).
Comment: Commenters encouraged DHS to consider the procedural and
logistical challenges of large-scale data collection and transmission
when developing the Personnel Surety portal component of CSAT.
Specifically, commenters suggested that DHS permit each high-risk
chemical facility to transmit data collectively (e.g., via a
spreadsheet or other readily available electronic means). In other
words, a high-risk chemical facility would collect the required
information in a single file (or series of files) and upload it to DHS.
Anything to the contrary--such as manual entry of discrete information
into data fields--would result in an undue burden to the regulated
community, increase human error, and raise information security
concerns.
Response: DHS will enable high-risk chemical facilities to upload
information electronically about multiple affected individuals
collectively. DHS would welcome suggestions about what technical
standards, formats, or export/import capabilities are in use by high-
risk chemical facilities to facilitate such data submission.
Comment: Many commenters suggested that third parties be authorized
to support data submission to the Department. Specifically, many
commenters suggested that DHS should permit third party vendors to
enter information into CSAT on a facility's
[[Page 18855]]
behalf. One commenter suggested that (1) Background check providers
understand the information security and privacy protections that apply
to information; (2) a web of Federal, State, and local laws protect
information (many corporations outsource personnel surety needs for
this reason); and (3) experienced background check providers will help
high-risk chemical facilities ensure that compliance with CFATS does
not cause noncompliance with other laws which govern the collection,
use, storage, or destruction of information.
Response: To support the submission of information by high-risk
chemical facilities, DHS has historically allowed--and will continue to
allow--authorized third-party access to CSAT as a Preparer. Information
about the CSAT Preparer user role can be found at http://www.dhs.gov/chemicalsecurity.
Comment: A few commenters suggested that high-risk chemical
facilities receive an electronic acknowledgement that the submitted
information has been received. Such an acknowledgement would aid in
demonstrating a high-risk chemical facility's compliance with 6 CFR
27.230(a)(12)(iv).
Response: DHS will send an electronic verification of submission to
high-risk chemical facilities when a high-risk chemical facility (1)
Submits information about an affected individual for the first time,
(2) submits updated or corrected information about an affected
individual, and/or (3) notifies DHS that an affected individual no
longer has access to restricted areas or critical assets.
(E) DHS solicited comments that respond to the Department's
interpretation of the population affected by RBPS-12's background check
requirement.
Comment: Many commenters provided extensive responses to the
Department's interpretation of the population which is affected by
RBPS-12. The comments suggested that the Department's interpretation
expanded the definition beyond the scope of CFATS. The comments
referenced the preamble to the CFATS Interim Final Rule, in which DHS
stated that each facility ``shall identify critical assets and
restricted areas and establish which employees and contractors may need
unescorted access to those areas or assets, and thus must undergo a
background check'' 72 FR 17708 (Apr. 7, 2007). Commenters also
suggested that vetting escorted facility personnel is inconsistent with
other regulatory schemes (e.g., TWIC).
Response: The regulatory text makes no distinction between facility
personnel who are escorted and facility personnel who are unescorted.
The actual text of CFATS, at 6 CFR 27.230(a)(12), uses the term
``unescorted'' to modify only the noun ``visitors.'' As such, if
facility personnel have access, either unescorted or otherwise (e.g.,
escorted), to restricted areas or critical assets, then they are
affected individuals who must be screened for the purposes of the
Personnel Surety Program.
However, the preamble to the CFATS Interim Final Rule could be read
to imply that a different population would undergo vetting rather than
the population suggested in the regulatory text of CFATS. To the extent
that there is a potential conflict, the regulatory text of CFATS takes
precedence. As such, the populations of individuals who must be vetted
under 6 CFR 27.230(a)(12) are the same as those described in the 60-day
notice preceding this 30-day notice: (1) Facility personnel (e.g.,
employees and contractors) with access (unescorted or otherwise) to
restricted areas or critical assets, and (2) unescorted visitors with
access to restricted areas or critical assets.
DHS would like to underscore that a high-risk chemical facility has
wide latitude in its unique and tailored SSP regarding the terms under
which facility personnel will be granted access, either unescorted or
otherwise, to restricted areas and critical assets. Each high-risk
chemical facility will need to consider its unique security concerns
when determining which individuals will be afforded access to
restricted areas or critical assets.
Additionally, DHS will expect that each facility be able to explain
why an individual is an affected individual. Specifically, an affected
individual must meet one and only one of the following three criteria:
(1) The individual is facility personnel with unescorted access to
restricted areas or critical assets; (2) the individual is facility
personnel with access, but not unescorted access, to restricted areas
or critical assets; or (3) the individual is an unescorted visitor with
access to restricted areas or critical assets.
(F) DHS solicited comments which respond to the statement that a
Federal law enforcement agency may, if appropriate, contact the high-
risk chemical facility as a part of a law enforcement investigation
into terrorist ties of facility personnel.
Comment: One commenter expressed concern that contact from a
Federal law enforcement agency about an individual who is properly on
the watchlist but is innocent nevertheless may result in adverse
employment decisions.
Response: Contact by a Federal law enforcement organization does
not necessarily indicate that any affected person is a known or
suspected terrorist. Further, employment decisions made by a high-risk
chemical facility in response to contact by a Federal law enforcement
agency are not regulated by CFATS. A corporation or facility should
ensure that it is complying with all applicable laws, including
applicable state regulations, when considering employment decisions.
It should also be noted that DHS will randomly audit its vetting
processes in an effort to maximize vetting accuracy and Personnel
Surety Program efficiency. As part of this auditing, DHS may request
information on a small percentage of affected individuals after those
individuals have been initially vetted against the TSDB. A request for
additional information does not imply, and should not be construed to
indicate, that an individual is known or suspected to be associated
with terrorism.
(G) DHS solicited comments which respond to the Department's
intention to seek an exception to the notice requirement under 5 CFR
1320.8(b)(3).
Comment: DHS received several comments in response to the
Department's intention to seek an exception to the PRA's notice
requirement. Every comment expressed concern about the impact to an
affected individual's right to be granted notice under the Privacy Act.
See 5 U.S.C. 552a(e)(3).
Response: The request for an exception to 5 CFR 1320.8(b)(3) is
related to the PRA and unrelated to the Privacy Act; 5 CFR 1320.8(b)(3)
requires that each collection of information shall inform and provide
reasonable notice to the potential persons to whom the collection of
information is addressed. The request by DHS for an exception to 5 CFR
1320.8(b)(3) from OMB will ensure that DHS will be relieved of the
potential obligation to require high-risk chemical facilities to
collect signatures or other positive affirmations of these notices from
affected individuals (although high-risk chemical facilities would not
be precluded from collecting signatures or other positive affirmations
of notice if this exception is granted). This exception will then
afford high-risk chemical facilities wide latitude in choosing how to
collect, recollect, or leverage already collected data based upon their
unique business operations and processes.
[[Page 18856]]
Because the information being collected under this information
collection request is information that will be used to identify
individuals with known or suspected terrorist ties, the Department
believes that it is important for affected individuals to be informed
of the Government's intended use of their information. However, under
CFATS the Department regulates high-risk chemical facilities and not
affected individuals. Although the affected individual is ultimately
the source of the collected information, the burden of submitting the
collected data to DHS lies on the high-risk chemical facility. (For
example, high-risk chemical facilities may collect affected
individuals' information by having affected individuals fill out forms,
or high-risk chemical facilities may submit batch files extracted from
databases which contain the necessary information previously collected
from affected individuals.) An exception to 5 CFR 1320.8(b)(3) will
ensure that the Department does not need to inspect, audit, or receive
confirmation (e.g., signatures of acknowledgement from affected
individuals) from high-risk chemical facilities where every affected
individual has received notice under the PRA of this information
collection.
The Department's request for an exception to 5 CFR 1320.8(b)(3) of
the PRA is not a request for an exception to provide notice to affected
individuals under the Privacy Act. If this exception is granted, high-
risk chemical facilities will be relieved of the potential obligation
to collect signatures or other positive affirmations from affected
individuals, but will still be obligated to affirm that required
privacy notice has been provided to affected individuals before
personal information is collected.
Comment: Several commenters suggested that affected individuals
should be notified in writing that they must undergo background checks
consistent with the requirements of 6 CFR 27.230 as a condition of
employment at any high-risk chemical facility. Commenters also
suggested that affected individuals should be advised of their rights
to contest the findings of background checks, and of how to contest
those findings.
Response: No affirmative written statements of this sort are
required by CFATS. However, DHS has discussed Personnel Surety Program
background check requirements in CFATS in the Advanced Notice of
Rulemaking preceding CFATS (71 FR 78276 (Dec. 28, 2006)), the CFATS
Risk-Based Performance Standards Guidance Document (May 2009), and the
Personnel Surety Program's 60-day PRA notice (74 FR 27555 (June 10,
2009)).
(H) DHS also received unsolicited comments in response to the 60-
day notice related to the CFATS Personnel Surety Program.
Comment: One commenter expressed disappointment in the proposed
information collection, because the commenter believed that the
collection approach did not guarantee the availability of all due
process protections under notice and comment rulemaking pursuant to the
Administrative Procedure Act (APA).
Response: Through this notice and through DHS's June 10, 2009, 60-
day PRA notice, 74 FR 27555 (June 10, 2009), DHS is fulfilling its
obligations to solicit and respond to public comment under the PRA.
DHS's PRA publications detail (1) which data points the Department will
collect in order to conduct vetting against the TSDB; (2) how the
Department will collect those data points; and (3) how the Department
will perform vetting against the TSDB. This type of program description
is the type of detail which is appropriate in a PRA notice, because it
allows DHS to solicit comments on how to improve the proposed
information collection and to consider ways to reduce the burden the
CFATS Personnel Surety Program will place on affected individuals and
high-risk chemical facilities.
Comment: Many commenters expressed concern that DHS would not
notify high-risk chemical facilities when affected individuals are
determined to be known or suspected terrorists. Commenters stated that
as a result of such lack of notification, high-risk chemical facilities
may unknowingly grant access to individuals who are known or suspected
to have terrorist ties, thereby subjecting facility personnel and
surrounding communities to unnecessary risk. Some of the commenters
acknowledged that there may be circumstances when it is either
appropriate or inappropriate to contact a facility in the context of a
law enforcement investigation, but stated that DHS should not withhold
TSDB vetting results as a general matter. Other commenters suggested
that DHS should always notify facilities about known or suspected
terrorists to enable appropriate facility action, such as potentially
limiting or denying known or suspected terrorists' access to restricted
areas or critical assets.
Response: DHS will not routinely notify high-risk chemical
facilities of Personnel Surety Program vetting results. DHS will
coordinate with Federal law enforcement entities to monitor and/or
prevent situations in which known or suspected terrorists have access
to high-risk chemical facilities. The precise manner in which DHS or
Federal law enforcement entities could contact high-risk chemical
facilities following vetting are beyond the scope of this PRA notice.
Comment: Commenters also suggested that failure to notify an
individual that he/she is a known or suspected terrorist would abrogate
that individual's right to request an administrative adjudication of a
finding under RBPS-12 that he/she is a potential security threat.
Response: Administrative adjudications which contest findings that
affected individuals are potential security threats are provided by 6
CFR 27.310(a)(1). The Department does not intend to limit affected
individuals' abilities to request administrative adjudications merely
because it will not routinely notify them of TSDB vetting results.
Individuals who believe they have been adversely affected by vetting
may file Notices of Application for Review with the Department.
Comment: One commenter recommended that DHS should not collect an
acknowledgement of State and local privacy law compliance from high-
risk chemical facilities. The commenter suggested that requiring a
compliance certification would add unnecessary procedural burden to the
Personnel Surety Program because DHS is not responsible for State or
local privacy law compliance.
Response: DHS agrees with the commenter and will not collect this
acknowledgement as part of Personnel Surety Program information
submissions.
Solicitation of Comments
The Office of Management and Budget is particularly interested in
comments which:
1. Evaluate whether the proposed collection of information is
necessary for the proper performance of the functions of the agency,
including whether the information will have practical utility;
2. Evaluate the accuracy of the agency's estimate of the burden of
the proposed collection of information, including the validity of the
methodology and assumptions used;
3. Enhance the quality, utility, and clarity of the information to
be collected; and
4. Minimize the burden of the collection of information on those
who are to respond, including through the use of appropriate automated,
electronic, mechanical, or other technological collection techniques or
other forms of information technology
[[Page 18857]]
(e.g., permitting electronic submissions of responses).
The Department is particularly interested in comments which:
1. Respond to the Department's interpretation of the population
affected by RBPS-12 background checks, as outlined in 6 CFR
27.230(a)(12);
2. Respond to fact that the Department or a Federal law enforcement
agency may, if appropriate, contact the high-risk chemical facility as
a part of a law enforcement investigation into terrorist ties of
facility personnel;
3. Respond to the Department's intention to collect information
that identifies the high-risk chemical facilities, restricted areas and
critical assets to which each affected individual has access; and
4. Respond to the Department on its intention to seek an exception
to the notice requirement under 5 CFR 1320.8(b)(3).
Analysis
Agency: Department of Homeland Security, National Protection and
Programs Directorate, Office of Infrastructure Protection,
Infrastructure Security Compliance Division.
Title: CFATS Personnel Surety Program.
Form: Not Applicable.
OMB Number: 1670-NEW.
Frequency: As required by the DHS-approved schedule.
Affected Public: High-risk chemical facilities as defined in 6 CFR
part 27, high-risk chemical facility personnel, and as appropriate,
unescorted visitors with access to restricted areas or critical assets.
Number of Respondents: 354,400 individuals.
Estimated Time per Respondent: 0.59 hours (35.4 minutes).
Total Burden Hours: 210,351.7 annual burden hours.
Total Burden Cost (capital/startup): $0.00.
Total Burden Cost (operating/maintaining): $17,669,543.
Dated: March 6, 2010.
Thomas Chase Garwood, III,
Chief Information Officer, National Protection and Programs
Directorate, Department of Homeland Security.
[FR Doc. 2010-8312 Filed 4-12-10; 8:45 am]
BILLING CODE 9110-9P-P