2011-14382. Chemical Facility Anti-Terrorism Standards Personnel Surety Program

AGENCY:

National Protection and Programs Directorate, DHS.

ACTION:

Response to comments received during 30-day comment period: New information collection request 1670-NEW.

SUMMARY:

The Department of Homeland Security (DHS or the Department), National Protection and Programs Directorate (NPPD), Office of Infrastructure Protection (IP), Infrastructure Security Compliance Division (ISCD) has submitted an information collection request (ICR) to the Office of Management and Budget (OMB) for review and clearance in accordance with the Paperwork Reduction Act of 1995 (PRA). The information collection is a new information collection. A 60-day public notice for comments was previously published in the Federal Register on June 10, 2009, at 74 FR 27555. A 30-day public notice for comments was published in the Federal Register on April 13, 2010, at 75 FR 18850. In the 30-day notice the Department responded to comments received during the 60-day comment period. This notice responds to comments received during the 30-day notice. This process is conducted in accordance with 5 CFR 1320.8.

FOR FURTHER INFORMATION:

A copy of the ICR, with applicable supporting documentation, may be obtained through the Federal Rulemaking Portal at http://www.regulations.gov.

SUPPLEMENTARY INFORMATION

Program Description

The Chemical Facility Anti-Terrorism Standards (CFATS), 6 CFR Part 27, require high-risk chemical facilities to submit information to the Federal government about facility personnel and, as appropriate, unescorted visitors with access to restricted areas or critical assets at those facilities. As part of the CFATS Personnel Surety Program this information will be vetted by the Federal government against the Terrorist Screening Database (TSDB) to identify known or suspected terrorists (KSTs). The TSDB is the Federal government's consolidated and integrated terrorist watchlist of known and suspected terrorists, maintained by the Department of Justice (DOJ) Federal Bureau of Investigation's (FBI) Terrorist Screening Center (TSC). For more information on the TSDB, see DOJ/FBI—019 Terrorist Screening Records System, 72 FR 47073 (August 22, 2007).

High-risk chemical facilities must also perform three other types of background checks in order to comply with CFATS' Personnel Surety Risk-Based Performance Standard 12 (RBPS-12). See 6 CFR 27.230(a)(12)(i)-(iii): High-risk chemical facilities must “perform appropriate background checks * * * including (i) Measures designed to verify and validate identity; (ii) Measures designed to check criminal history; [and] (iii) Measures designed to verify and validate legal authorization to work.” These three other types of background checks are not the subjects of this notice, nor are they subjects of the underlying ICR or of the 30- or 60-day notices preceding this notice. The CFATS Personnel Surety Program is not intended to halt, hinder, or replace these three other types of background checks, nor is it intended to halt, hinder, or replace high-risk chemical facilities' performance of background checks which are currently required for employment or access to secure areas of those facilities.

Background

On October 4, 2006, the President signed the DHS Appropriations Act of 2007 (the Act), Public Law 109-295. Section 550 of the Act (Section 550) provides DHS with the authority to regulate the security of high-risk chemical facilities. DHS has promulgated regulations implementing Section 550, the Chemical Facility Anti-Terrorism Standards, 6 CFR Part 27.

Section 550 requires that DHS establish Risk Based Performance Standards (RBPS) as part of CFATS. RBPS-12 (6 CFR 27.230(a)(12)(iv)) requires that regulated chemical facilities implement “measures designed to identify people with terrorist ties.” The ability to identify individuals with terrorist ties is an inherently governmental function and requires the use of information held in government-maintained databases, which are unavailable to high-risk chemical facilities. Therefore, DHS is implementing the CFATS Personnel Surety Program, which will allow chemical facilities to comply with RBPS-12 by implementing “measures designed to identify people with terrorist ties.”

DHS has submitted the proposed information collection for the CFATS Personnel Surety Program to OMB for review and clearance in accordance with the Paperwork Reduction Act of 1995.

Overview of CFATS Personnel Surety Process

The CFATS Personnel Surety Program will work with the DHS Transportation Security Administration (TSA) to identify individuals who have terrorist ties by vetting information submitted by each high-risk chemical facility against the TSDB.

High-risk chemical facilities or their designees will submit the information of: (1) Facility personnel who have or are seeking access, either unescorted or otherwise, to restricted areas or critical assets; and (2) unescorted visitors who have or are seeking access to restricted areas or critical assets. These persons, about whom high-risk chemical facilities and facilities' designees will submit information to DHS, are referred to in this notice as “affected individuals.” ^[1]

Information will be submitted to NPPD through the Chemical Security Assessment Tool (CSAT), the online data collection portal for CFATS. The high-risk chemical facility or its designees will submit the information of affected individuals to DHS through CSAT. The submitters of this information (“Submitters”) for each high-risk chemical facility will also affirm, to the best of their knowledge, that the information is: (1) True, correct, and complete; and (2) collected and submitted in compliance with the facility's Site Security Plan (SSP) or Alternative Security Program (ASP), as reviewed and authorized and/or approved in accordance with 6 CFR 27.245. The Submitter(s) of each high-risk chemical facility will also affirm that, in accordance with their Site Security Plans, notice required by the Privacy Act of 1974, 5 U.S.C. 552a, has been given to affected individuals before their information is submitted to DHS.

DHS will send a verification of receipt (previously referred to as a “verification of submission” in the 60-day and 30-day notices) to the submitter(s) of each high-risk chemical facility when a high-risk chemical facility: (1) Submits information about an affected individual for the first time; (2) submits additional, updated, or corrected information about an affected individual; and/or (3) notifies DHS that an affected individual no longer has or is seeking access to that facility's restricted areas or critical assets.

Upon receipt of each affected individual's information in CSAT, NPPD will send a copy of the information to TSA. Within TSA, the Office of Transportation Threat Assessment and Credentialing (TTAC) conducts vetting against the TSDB for several DHS programs. TTAC will compare the information of affected individuals collected by DHS (via CSAT) to information in the TSDB. TTAC will forward potential matches to the TSC, which will make a final determination of whether an individual's information is identified as a match to a record in the TSDB.

In the event that an affected individual's information is confirmed to match a record in the TSDB (which DHS refers to as a “match to the TSDB,” or simply as a “match”), the TSC will notify NPPD and the appropriate Federal law enforcement agency for coordination, investigative action, and/or response, as appropriate. NPPD will not routinely provide vetting results to high-risk chemical facilities nor will it provide results to an affected individual whose information has been submitted by a high-risk chemical facility. As warranted, high-risk chemical facilities may be contacted by DHS or Federal law enforcement agencies as part of law enforcement investigation activity.

Information Collected

DHS may collect the following information about affected individuals:

• Full name;
• Aliases;
• Date of birth;
• Place of birth;
• Gender;
• Citizenship;
• Passport information;
• Visa information;
• Alien registration number;
• DHS Redress Number (if available).

For purposes of clarifying the exact data points which will be routinely collected as part of the CFATS Personnel Surety Program, the Department offers the following data clarification to the public. Under this information collection, the Department will require that high-risk chemical facilities submit the following information about affected individuals that are U.S. Citizens and Lawful Permanent Residents, for vetting against the TSDB:

a. Full name;

b. Date of birth; and

c. Citizenship or Gender.

The Department will require that high-risk chemical facilities submit the following information about affected individuals that are Non-U.S. Persons, for vetting against the TSDB:

a. Full name;

b. Date of birth;

c. Citizenship; and

d. Passport information and/or alien registration number.

To reduce the likelihood of false positives in matching against the TSDB, high-risk chemical facilities may also (optionally) submit the following information about affected individuals:

a. Aliases;

b. Gender (for Non-U.S. persons);

c. Place of birth; and

d. DHS Redress Number.

In lieu of conducting new TSDB vetting of an affected individual, DHS may collect information to verify that an affected individual is currently enrolled in a DHS program that also requires a TSDB check equivalent to the TSDB vetting performed as part of the CFATS Personnel Surety Program. For purposes of clarifying the exact data points which will be routinely collected as part of the CFATS Personnel Surety Program, the Department offers the following data clarification to the public. To verify enrollment in a DHS screening program, the high-risk chemical facility must submit the affected individual's:

a. Full Name;

b. Date of Birth; and

c. Program-specific information or credential information, such as unique number, or issuing entity (e.g., State for Commercial Driver's License with an Hazardous Materials Endorsement).

When verifying enrollment in a DHS screening program, the high-risk chemical facility may also (optionally) submit the affected individual's:

a. Aliases;

b. Place of birth;

c. Gender;

d. Citizenship; and

e. DHS Redress Number.

If high-risk chemical facilities find it administratively easier to submit to DHS the routine vetting information of an affected individual, even if the affected individual has been previously vetted, facilities may do so. In that case, DHS will vet affected individuals against the TSDB, and will not seek to verify an affected individual's enrollment in TWIC, HME, NEXUS, SENTRI or FAST.

DHS will collect information that identifies the high-risk chemical facility or facilities, to which the affected individual has or is seeking access to restricted areas or critical assets.

DHS may contact a high-risk chemical facility to request additional information (e.g., visa information) pertaining to particular individuals in order to clarify suspected data errors or resolve potential matches (e.g., in situations where an affected individual has a common name). Such requests will not imply, and should not be construed to indicate, that an individual's information has been confirmed as a match to a TSDB record.

In the event that a confirmed match is identified as part of the CFATS Personnel Surety Program, DHS may obtain references to and/or information from other government law enforcement and intelligence databases, or other relevant databases that may contain terrorism information.

DHS may collect information necessary to assist in tracking submissions and transmission of records, including electronic verification that DHS has received a particular record.

DHS may also collect information about points of contact at each high-risk chemical facility, and which points of contact the Department or Federal law enforcement personnel may contact with follow-up questions. A request for additional information from DHS does not imply, and should not be construed to indicate, that an individual is known or suspected to be associated with terrorism.

DHS may also collect information provided by individuals or high-risk chemical facilities in support of any redress requests or any adjudications initiated under CFATS.

DHS may request information pertaining to affected individuals, previously provided to DHS by high-risk chemical facilities, in order to confirm the accuracy of that information, or to conduct data accuracy reviews and audits as part of the CFATS Personnel Surety Program.

DHS will also collect administrative or programmatic information (e.g., affirmations or certifications of compliance, extension requests, brief surveys for process improvement, etc.) necessary to manage the CFATS Personnel Surety Program.

The Department will also collect information that will allow high-risk chemical facilities to manage their data submissions. Specifically, the Department will make available to high-risk chemical facilities two blank data fields. These blank data fields may be used by a high-risk chemical facility to assign each record of an affected individual a unique designation or number that is meaningful to the high-risk chemical facility. Collecting this information will enable a high-risk chemical facility to manage the electronic records it submits into CSAT. Entering this information into CSAT will be completely voluntary, and is intended solely to enable high-risk chemical facilities to search through, sort, and manage the electronic records they submit into.

Responses to Comments Received During the CFATS Personnel Surety Program ICR 30-Day Comment Period

The Department received 20 comments in response to the 30-day notice for comment. Comments were received from eight private sector companies; nine associations; one training council; one union; and one council composed of chemical industry trade associations. Many of the comments were in response to the questions posed by the Department in the 30-day notice for comments. The Department first addresses comments responding to questions posed in the 30-day notice, and then responds to unsolicited comments received in response to the 30-day notice.

(A) On Behalf of OMB, DHS Solicited Comments That Evaluate Whether the Proposed Collection of Information Is Necessary for the Proper Performance of the Functions of the Agency, Including Whether the Information Will Have Practical Utility

Comment: The Department received several comments addressing whether the proposed collection of information had any practical utility. One commenter suggested that the CFATS Personnel Surety Program does not provide owners or operators of regulated facilities with a value-added tool to screen potential personnel, contractors, and visitors or to identify potential security risks. Another commenter suggested that the proposed program is a one-way process that provides information to the Department on personnel with access to restricted areas, without any feedback provided to the owners or operators of regulated facilities on their personnel. In contrast, one commenter stated that, “[i]n the context of CFATS requirements for personal surety and protecting the nation's chemical infrastructure, the consolidated and integrated terrorist watchlist, even with [its] limitations * * * is likely the best check for potential terrorists by DHS compared to other methods and information.”

Response: The CFATS Personnel Surety Program is necessary for the proper performance of the functions of the Department, including protecting chemical facilities and the nation from terrorist attacks. DHS will perform this responsibility by identifying individuals with terrorist ties that have or are seeking access to restricted areas or critical assets at high-risk chemical facilities. The CFATS Personnel Surety Program also has practical utility—enabling the Federal government to take appropriate follow-up action if it determines that known or suspected terrorists have or seek access to restricted areas or critical assets at high-risk chemical facilities.

Comment: One commenter stated that the information collection and vetting processes described in the 30-day notice appeared to be an attempt to shift responsibility from the government to the private sector. The commenter suggested that the 30-day notice read as though facilities will assist the Federal government in the performance of anti-terrorism duties.

Response: High-risk chemical facilities will submit information pertaining to affected individuals to DHS as part of the CFATS Personnel Surety Program. In the preamble to the CFATS Interim Final Rule (IFR), DHS stated that background checks identifying individuals with terrorist ties, required by 6 CFR 27.230(a)(12)(iv), can only be achieved by conducting vetting against the TSDB. See 72 FR 17709 (Apr. 9, 2007). Determining whether individuals' information matches a record in the TSDB necessarily includes checks of data sets that are not commercially available. The design of the CFATS Personnel Surety Program will allow high-risk chemical facilities to comply with 6 CFR 27.230(a)(12)(iv) by submitting information necessary for DHS to conduct vetting against the TSDB.

Comment: DHS received comments regarding individuals who have previously undergone TSDB vetting equivalent to CFATS Personnel Surety Program TSDB vetting, and who have been subsequently issued and currently maintain active, valid credentials or endorsements (e.g., Transportation Worker Identification Credentials) as a result of that previous vetting. Commenters stated that the Department's collection of information from facilities about these affected individuals: (1) Serves no security purpose; (2) means that the Department is not granting TSDB vetting reciprocity between its own programs; and (3) is redundant, particularly in situations where commenters believe that other DHS credentialing programs have more stringent vetting criteria than CFATS. Several commenters requested clarification on which Federal credentialing programs the Department will recognize as conducting TSDB checks equivalent to CFATS Personnel Surety Program TSDB checks.

Response: The 30-day notice reiterated the Department's position, first outlined in the preamble to the IFR, that DHS supports the sharing and reuse of vetting results. See 72 FR 17709 (Apr. 9, 2007). An affected individual will not need to undergo additional vetting as part of the CFATS Personnel Surety Program if he/she has successfully undergone TSDB vetting, and possesses a valid credential or endorsement, as part of the Department's Transportation Worker Identification Credential (TWIC) program, Hazardous Materials Endorsement (HME) program, NEXUS program, Secure Electronic Network for Travelers Rapid Inspection (SENTRI) program, or Free and Secure Trade (FAST) program. DHS must collect a limited amount of information for that affected individual, however, to determine that the affected individual is currently enrolled in an above-listed DHS program. This information is necessary (1) To verify that the affected individual is currently enrolled in the DHS program, and (2) to enable DHS to access both the original enrollment data and the TSDB vetting results already in the possession of the Department, when necessary. The following information is necessary to verify an affected individual's enrollment in a DHS program:

	TWIC	HME	NEXUS	SENTRI	FAST
Name	Required	Required	Required	Required	Required.
Date of Birth	Required	Required	Required	Required	Required.
Unique Credential Information	—TWIC Serial Number: Required —Expiration Date: Required.	—Commercial Driver's License (CDL) Issuing State(s): Required —CDL Number: Required. —Expiration Date: Required.	—PASS Number: Required —Expiration Date: Required.	—PASS Number: Required —Expiration Date: Required.	—PASS Number: Required. —Expiration Date: Required.

If DHS cannot confirm an affected individual's current enrollment in one of the previously mentioned programs, or if previous vetting results cannot be verified, DHS will either: (1) Notify the high-risk chemical facility that the Department could not verify that the affected individual is currently enrolled in a DHS program; and/or (2) vet the affected individual against the TSDB. When a high-risk chemical facility is notified that the Department could not verify that the affected individual is currently enrolled in a DHS program, the high-risk chemical facility must either: (1) Submit additional information, which corrects or updates the previous information to verify enrollment; or (2) provide sufficient information for the Department to conduct vetting of the affected individual against the TSDB. Such notifications from DHS will not imply, and should not be construed to indicate, that an individual has been confirmed as a match to the TSDB.

If high-risk chemical facilities find it administratively easier to submit information about affected individuals for vetting against the TSDB (rather than leveraging previous vetting against the TSDB), high-risk chemical facilities may do so. In that case, DHS will vet affected individuals against the TSDB, and will not seek to verify an affected individual's enrollment in TWIC, HME, NEXUS, SENTRI, or FAST.

Comment: Several commenters suggested that the Department was not following recently-issued White House recommendations to promote comparability and reciprocity across credentialing and screening programs. One commenter specifically referred to Recommendation 16 of the Surface Transportation Security Priority Assessment, which recommends that the Federal government “Create a more efficient Federal credentialing system by reducing credentialing redundancy, leveraging existing investments, and implementing the principle of `enroll once, use many' to reuse the information of individuals applying for multiple access privileges.” See The White House (March 2010), http://www.whitehouse.gov/​sites/​default/​files/​rss_​viewer/​STSA.pdf.

Response: The design of the CFATS Personnel Surety Program aligns with the recommendations of the Surface Transportation Security Priority Assessment.

In discussions with high-risk chemical facilities, DHS has discovered that the concept of “enroll once, use many” may have been misinterpreted by commenters as meaning that an individual should only need to submit information to DHS once, and that DHS should never collect information from that individual again. DHS, however, defines the “enroll once, use many” concept as the ability to reuse previously-submitted program enrollment information and/or vetting results, upon collection of sufficient information to confirm an individual's prior enrollment in a DHS program or prior vetting results. High-risk chemical facilities will have to submit affected individuals' personal data to DHS as part of the CFATS Personnel Surety Program in order for DHS to reuse previously-submitted enrollment information and previous vetting results. The CFATS Personnel Surety Program will require only the minimum information necessary to verify affected individuals' enrollments in the TWIC, HME, NEXUS, SENTRI, and FAST programs.

Comment: Several commenters suggested that it may be reasonable for DHS to require chemical facilities to perform visual inspections of TWICs and other existing credentials, but that requiring chemical facilities to submit data pertaining to affected individuals possessing such other credentials would not serve any legitimate security purpose. Further, one commenter stated that facilities not regulated under the Maritime Transportation Security Act (MTSA) should not be expected to obtain “readers” for TWIC credentials.

Response: As previously discussed, DHS will collect information about affected individuals who are currently enrolled in certain DHS programs with equivalent TSDB vetting to verify that each affected individual is currently enrolled in the TWIC, HME, NEXUS, SENTRI, and/or FAST programs.

DHS agrees that there is no expectation or requirement that non-MTSA facilities be equipped with TWIC readers. DHS also emphasizes that TWICs are not required for persons accessing facilities regulated by CFATS. High-risk chemical facilities may, however, choose to leverage TWIC credentials as part of the identity, legal authorization to work, and criminal history background checks they perform as part of 6 CFR 27.230(a)(12)(i)-(iii). The precise manners in which high-risk chemical facilities could leverage TWIC credentials as part of identity, legal authorization to work, and criminal history background checks could vary from facility to facility, and should be described in individual facilities' SSPs. The precise manners in which facilities could leverage TWIC credentials as part of these other background checks are beyond the scope of this Paperwork Reduction Act response to comments.

Comment: Several commenters suggested that the Department should accept vetting results from other Federal agencies, namely the Bureau of Alcohol, Tobacco, Firearms, and Explosives (ATF), which conduct vetting against the TSDB. Commenters suggested that without this accommodation, the Department would impose unreasonable burdens on a segment of the community regulated by more than one Federal agency without any corollary enhancement to security.

Response: ATF conducts point-in-time vetting against the TSDB, which means that ATF's checks are conducted at only specified times, not on a recurrent basis. Recurrent vetting is a DHS best practice, and compares an affected individual's information against new and/or updated TSDB records as new and/or updated records become available.

(B) On Behalf of OMB, DHS Solicited Comments Which Evaluate the Accuracy of the Department's Estimate of the Burden of the Proposed Collection of Information, Including the Validity of the Methodology and Assumptions Used

Comment: The Department received comments which supported the proposed CFATS Personnel Surety Program information submission schedule, published in the Federal Register on April 13, 2010, at 75 FR 18853, as part of the Department's 30-day notice. The Department also received comments raising the point that the proposed schedule would create situations in which an affected individual's name will be submitted to DHS after he/she no longer has access to a high-risk chemical facility. Several commenters highlighted this issue by pointing out that commercial delivery companies may not always send the same driver to a high-risk chemical facility.

Response: Based in part on commenters' concerns, DHS will revise the proposed information submission schedule previously published in the 30-day notice. The revised schedule will be published in the Federal Register and/or disseminated to high-risk chemical facilities individually, and will align with the RBPS Metric 12.1 for “new/prospective employees [facility personnel] & unescorted visitors.” (See Table 17 in the May 2009 Risk Based Performance Standards Guidance, http://www.dhs.gov/​xlibrary/​assets/​chemsec_​cfats_​riskbased_​performance_​standards.pdf.) Specifically, the revised schedule will require high-risk chemical facilities to submit the information of new affected individuals prior to access to restricted areas or critical assets. The Department is considering whether to establish that high-risk chemical facilities be required to submit the information at least 48 hours prior to access to restricted areas or critical assets. The Department may, on a case by case basis, allow for variances from the schedule.

In response to the comments received about commercial delivery drivers, DHS reminds the public that RBPS-12 applies only to facility personnel with access to a high-risk chemical facility's restricted areas or critical assets, and to unescorted visitors with access to a high-risk chemical facility's restricted areas or critical assets. Situations that require visitors to generally access a high-risk chemical facility will not result in submission of information for vetting under the CFATS Personnel Surety Program if the visitors do not have access to restricted areas or critical assets, or if the visitors are escorted through restricted areas and critical assets. If commercial delivery drivers visiting high-risk chemical facilities are escorted, or if they do not have access to restricted areas or critical assets in the first place, then they will not be affected individuals and will not be vetted under the CFATS Personnel Surety Program.

If a high-risk chemical facility opts to allow visitors (e.g., commercial truck drivers) unescorted access to its restricted areas or critical assets, the visitors will be considered affected individuals and the facility will be required to both (1) Perform background checks on the unescorted visitors as required under 6 CFR 27.230(a)(12)(i)-(iii), and (2) submit information pertaining to those visitors to the Department to identify individuals with terrorist ties. The Department recognizes that this may, or may not, necessitate changes in business operations of high-risk chemical facilities.

Comment: Many commenters suggested the Department did not accurately estimate the burden to high-risk chemical facilities because it underestimated the affected population. The commenters suggested a total population of 10,000,000 affected individuals, rather than the Department's estimate of 1,063,200 affected individuals. Using the Department's estimated time per respondent of 0.59 hours, commenters estimated 6,000,000 burden hours. The majority of commenters used an average hourly rate of $20.00. Commenters estimated that total annual cost of the CFATS Personnel Surety Program would be $120,000,000.

Response: DHS disagrees with several of the commenters' assumptions that resulted in the $120,000,000 estimate. First, commenters suggested that the ICR estimate of 1,063,200 total respondents (i.e., affected individuals) did not account for agricultural retail or distribution facilities that cannot isolate restricted areas or critical assets to a limited number of employees or visitors. In the CFATS Regulatory Assessment the Department approximated compliance costs through the use of model facility categories. See CFATS Regulatory Assessment, section 5.1 (Apr. 1, 2007), http://www.regulations.gov/​#!documentDetail;​D=​DHS-2006-0073-0116. Model facility categories were created using four variables: (1) To which of the four risk-based tiers a covered facility is assigned; (2) whether a covered facility is “enclosed” (inside a building) or “open” (not inside a building); (3) the size of a covered facility (large or small); and (4) whether the chemicals at a covered facility are at risk of theft or diversion for subsequent use as weapons or weapons components. These variables provided the Department with 16 variations for which different estimates could be approximated. See CFATS Regulatory Assessment at 23, table 15 (Apr. 1, 2007). Several of the variations of these model facility categories, notably Tier 4 Groups A, B, and C, do account for agricultural retail or distribution facilities that cannot isolate restricted areas or critical assets to a limited number of employees or visitors. Therefore, the Department believes that the information collection does reasonably account for agricultural retail or distribution facilities that cannot isolate restricted areas or critical assets to a limited number of facility personnel or unescorted visitors.

Second, some commenters assumed that the Department failed to account for respondents at facilities that would be required to submit Top-Screen consequence assessments to DHS if the “indefinite time extension” issued by the Department on January 9, 2008 is lifted. The Department disagrees with the commenters because the total respondent estimate used by the Department was derived from the CFATS Regulatory Assessment, which was published (on April 1, 2007) prior to the “indefinite time extension” (issued on January 9, 2008). The CFATS Regulatory Assessment assumed the inclusion of these facilities when estimating the population of individuals affected by Personnel Surety costs.

The third assumption that commenters used to support an estimated total number of 10,000,000 affected individuals was that the Department should include the population of individuals working at approximately 3,200 MTSA-regulated facilities in its estimate of the population of affected individuals. The Department is precluded from including any population in the total number of respondents explicitly excluded from regulation under CFATS. MTSA facilities are excluded from regulation under CFATS by Section 550.

Commenters also suggested that many high-risk facilities in the retail segment could see large numbers of visitors (i.e., customers) entering facilities during peak retail times of the year. The commenters suggested that depending on how the Department defines “unescorted visitor,” the total annual number of respondents could be an order of magnitude greater than the 354,400 figure estimated by the agency. Commenters did not specify any order of magnitude, so the Department assumed that commenters were suggesting that during peak times of the year the Department should estimate an increase of one order of magnitude (i.e., 3,189,600 affected individuals) above the Department's current annual population estimate.^[2] The Department does not believe that high-risk chemical facilities in the retail segment will opt to conduct the other background checks required under 6 CFR 27.230(a)12(i)-(iii) on these individuals due to the cost and burden that would place on the high-risk chemical facility. Hence, high-risk chemical facilities in the retail segment will likely ensure, through their access controls, that customers will not become affected individuals. Therefore, the Department has chosen not to modify the total number of respondents based upon peak retail times of the year.

The Department has concluded that the comments which estimated that the total annual cost on the regulated community of the CFATS Personnel Surety Program would be $120,000,000 were based on inaccurate assumptions.

Comment: One commenter stated that it conducted a study of twelve industry members and subsequently concluded the Department had significantly underestimated the burden on the industry.

Response: The Department requested from the commenter, and was subsequently provided, the survey data underlying the study referenced in the commenter's response. The survey requested information and specific numeric data from 34 facilities (owned and operated by 12 industry members). The facilities ranged from a small research facility to several large facilities. The Department concluded that an increase in the estimated number of respondents was justified, based on the survey data received.

The Department has concluded that the type of facilities surveyed generally aligned with Group A facilities (described in section 5.1 of the CFATS Regulatory Assessment). Based on the survey, and based on a brief description of facilities responding to the survey, the Department increased, for the purposes of this ICR, the estimate of Group A facilities by an order of magnitude thus matching the results of the survey.

In reviewing the comments, as well as the survey data provided, the Department identified a minor computational error when calculating the total annual number of respondents in the 60-day and 30-day notices. Specifically, the Department in the 30-day and 60-day notices improperly assumed that total number of respondents as 1,063,200 affected individuals over a three-year period. Rather in the CFATS Regulatory Assessment the Department had assumed the total population of individuals to be screened at 1,063,200 with an additional annual turnover that resulted in an additional 177,290 respondents during the second and third years. Therefore, in the 60-day and 30-day notices the Department should have estimated a total number of respondents over three years as 1,417,780 resulting in 472,593 annual number of respondents.

In accounting for this minor computational error, and for the increase of Group A facilities by an order of magnitude, the Department has revised its average total annual number of respondents from 354,400 to 1,303,700. As a consequence, the estimated time per respondent (i.e., total burden hours/number of respondents) was revised from 0.59 hours to 0.54 hours.

Comment: Three of the four commenters that analyzed the estimated costs outlined in the 30-day notice suggested an appropriate wage rate of $20 per hour while the fourth commenter suggested the wage rate would range between $20 and $40 per hour.

Response: Based upon the commenters' suggestions, the Department has modified the wage rate. Since comments on the appropriate wage rate ranged from $20 to $40 per hour, we picked the midpoint of $30 for our hourly wage rate. To account for the cost of employee benefits such as paid leave, insurance, retirement, etc., we multiplied the base wage rate of $30 by 1.4 to arrive at a fully loaded wage rate of $42 per hour.^[3] The updated analysis and costs submitted to OMB as part of the CFATS Personnel Surety Program ICR are reflected at the conclusion of this notice.

Comment: Many commenters suggested that the Department did not accurately estimate the burden because the estimate was limited to those activities listed in 5 CFR 1320.3(b)(1). Commenters suggested that such a limit does not account for unnecessary investigations, or for justified or unjustified adverse employment decisions that could result from a person's possibly unjustified presence on the TSDB. One commenter expressed concern that the Department's estimate did not account for the burden on affected individuals whose information matches that of records in the TSDB, but who are not in fact terrorists.

Response: The activities which the Department must account for when estimating the burden of an ICR are limited in scope to those activities listed in 5 CFR 1320.3(b)(1). Specifically, 5 CFR 1320.3(b)(1) requires the Department to estimate the total time, effort, or financial resources expended by persons to generate, maintain, retain, disclose, or provide information to or for a Federal agency. The potential burden described by the commenters is not related to the burden high-risk chemical facilities incur in collecting and submitting the information of affected individuals to DHS, nor is it within the scope of the activities listed in 5 CFR 1320.3(b)(1).

(C) On Behalf of OMB, DHS Solicited Comments To Enhance the Quality, Utility, and Clarity of the Information To Be Collected

Comment: One commenter suggested that requiring covered facilities to collect, submit and maintain affected individuals' information creates a situation subject to data entry errors and presents a significant challenge to maintain current information.

Response: The Department has made an effort to create a user-friendly Web tool (in CSAT) that will reduce data entry errors. Hence, the Department believes that Submitters of high-risk chemical facilities will be able to affirm that, to the best of their knowledge, information submitted to DHS as part of the CFATS Personnel Surety Program is true, correct, and complete.

Comment: One commenter suggested that it would be inappropriate to require facilities to submit affected individuals' information to DHS. The commenter suggested that requiring covered facilities to collect, verify, submit, and maintain this information creates an increased legal liability for covered facilities that have to accurately and timely collect, verify, submit, maintain and protect this sensitive information.

Response: DHS presumes that chemical facilities, as employers, have access to basic biographical information (such as names, dates of birth, genders, and citizenships) of many facility personnel and visitors.

As part of RBPS-12, each high-risk chemical facility is also required to conduct background checks to verify the identity, legal authorization to work, and criminal history of affected individuals. Many high-risk chemical facilities are collecting, verifying, and properly maintaining information necessary for these other verifications already. This already-collected information should include many, if not most of the necessary data elements required for submission to DHS to complete the check for an individual's ties to terrorism.

Comment: A few commenters stated that high risk chemical facilities are rarely in a legal position to guarantee the truth, correctness or completeness of information related to contractors, vendors, truck drivers or any other non-employees. Requiring signed documents by company officials will not ensure that information from parties outside of their legal control is true, correct, and complete. One commenter expressed concern that company or facility representatives are not experts in determining the validity of identification, and the affirmation statements the Department will require each Submitter to affirm should be modified to be “the same information presented by the affected individual.”

Response: Each Submitter will be expected to affirm, to the best of his/her knowledge, that the information he/she submits to DHS on behalf of a high-risk chemical facility for vetting against the TSDB is true, correct, and complete. In the event that a high-risk chemical facility submits incorrect information through no fault of its own, the Department will expect the high-risk chemical facility to update the information in accordance with the proposed submission schedule. Steps that high-risk chemical facilities might take to validate personal information collected as part of identity, legal authorization to work, or criminal history checks are beyond the scope of this notice and are beyond the scope of the CFATS Personnel Surety Program ICR.

Comment: The Department received comments requesting clarity as to whether covered facilities should submit names of emergency personnel who would qualify as affected individuals. One commenter noted a CFATS Frequently Asked Question (FAQ) which indicated that fire department personnel would not be required to undergo background checks.

Response: The Department expects high-risk chemical facilities to submit the information of affected individuals in accordance with the submission schedule to be published or disseminated by the Department. For purposes of RBPS-12, the Department affirms that certain populations are not affected individuals. Specifically: (1) Federal officials that gain unescorted access to restricted areas or critical assets as part of the performance of their official duties are not affected individuals; (2) law enforcement officials at the state or local level that gain unescorted access to restricted areas or critical assets as part of the performance of their official duties are not affected individuals; and (3) emergency responders at the state or local level that gain unescorted access to restricted areas or critical assets during emergency situations are not affected individuals. This aligns with the population assumptions for the CFATS Personnel Surety Program embedded within the Regulatory Assessment.

The Department has updated FAQ 1368 (see http://csat-help.dhs.gov), and appreciates the comment which brought the FAQ to the Department's attention.

Comment: One commenter suggested that the Department is requesting information beyond what is required to identify people with terrorist ties when collecting work phone numbers and work email addresses. The commenter also suggested that collecting additional information for auditing purposes is beyond the scope of CFATS.

Response: DHS no longer plans to routinely collect affected individuals' work phone numbers and work email addresses. The Department disagrees, however, that collection of information for auditing purposes is beyond the scope of CFATS.

Comment: Several commenters suggested that the burden would be difficult to estimate unless the Department provided definitions for such terms as “contractor” and “vendor.”

Response: Individual high-risk facilities may classify particular contractors or vendors, or categories of contractors or vendors, either as “facility personnel” or as “visitors.” This determination should be a facility-specific determination, and should be based on facility security, operational requirements, and business practices. The Department's estimates regarding the information collection burden of the Personnel Surety Program reflect this approach.

Comment: One commenter was not aware of any facility that currently maintains, in an easily accessible or transferrable format, the information required for submission discussed in the ICR.

Response: The Department believes that the information necessary to identify individuals with terrorist ties is already in the possession of many high-risk chemical facilities, due to the other background checks already performed by those facilities. The burden outlined in this ICR accounts for the fact that some facilities do not possess this information, and that others do not possess this information in easily accessible or transferrable formats.

Comment: One commenter suggested that various flaws in the TSDB and various flaws in the Federal government's watchlisting protocols need to be addressed in order to make the CFATS Personnel Surety Program viable and fair.

Response: As indicated in the CFATS IFR, the Department has determined that a TSDB check is necessary for the purpose of protecting restricted areas and critical assets of high-risk chemical facilities from persons who may have ties to terrorism. See 72 FR 17708 (Apr. 9, 2007). The TSDB is the Federal government's integrated and consolidated terrorist watchlist and is the appropriate database to use to identify individuals with terrorist ties. Discussions regarding TSDB flaws and the Federal government's watchlisting protocols are beyond the scope of this notice.

Comment: One commenter requested clarity about the Department's reference that it may “collect information on affected individuals as necessary to enable it to provide redress.” Another commenter expressed concern that the CFATS Personnel Surety Program design does not set up a uniform, thorough system that gives workers full appeals or waiver procedures. Several commenters expressed concern about how the Department would provide meaningful redress under the design of the CFATS Personnel Surety Program.

Response: An ICR is not the appropriate vehicle for the Department to use to address privacy and redress issues related to the CFATS Personnel Surety Program. The Department will publish a Privacy Impact Assessment (PIA) about the CFATS Personnel Surety Program, to be made available on the Department's Web page at http://www.dhs.gov/​privacy and http://www.dhs.gov/​chemicalsecurity. The Department will also publish a System of Records Notice (SORN) for the CFATS Personnel Surety Program, and a Notice of Proposed Rulemaking proposing to take certain Privacy Act exemptions for the CFATS Personnel Surety Program System of Records.

(D) On Behalf of OMB, DHS Solicited Comments Regarding the Minimization of the Burden of Information Collection on Those Who Are To Respond, Including Tthrough the Use of Aappropriate Automated, Electronic, Mechanical, or Other Technological Collection Techniques or Other Forms of Information Technology (e.g., Permitting Electronic Submissions of Responses)

Comment: Three commenters suggested that the Department should allow private third parties to submit information of individuals to DHS on behalf of chemical facilities. Specifically, these commenters suggested that if private third parties could directly submit information, substantial burden could be eliminated for high-risk chemical facilities. Another commenter suggested that the Department should provide a means through which non-employees would be able to directly provide their information to the Department.

Response: As part of the Personnel Surety Program, DHS will also allow facilities to designate third party individuals as Submitters. Designated individuals will be able to submit TSDB screening information to DHS on behalf of the facilities that designate them as Submitters.

Comment: Commenters suggested that the ICR places undue burdens and costs on businesses that operate multiple regulated facilities where redundant information submissions would be required for a given individual who visits multiple sites.

Response: The Department has taken steps to minimize the potential for an affected individual's information to be submitted multiple times. Further, in the event that an affected individual's information is submitted to the Department multiple times, only one record will be transmitted to TSA to be vetted against the TSDB.

The primary step the Department has taken to minimize the potential for an affected individual's information to be submitted multiple times is ensuring that companies with many high-risk chemical facilities have flexibility to consolidate CSAT user roles. Specifically, CSAT will provide companies the flexibility either to consolidate their user roles to allow a single Submitter for many facilities, or to elect for each facility to independently submit information to the Department. Each company may implement the best strategy for itself.

Comment: Several commenters suggested that requiring facilities to update and correct information about affected individuals will neither “increase the accuracy of data collected,” nor “decrease the probability of incorrect matches” against the TSDB. The commenters further suggested that updating and correcting information will significantly increase the administrative burden on companies required to provide the information and will also increase the likelihood that data may be incomplete and/or inaccurate.

Response: The Department is confident that matching correct and accurate information against records in the TSDB increases the accuracy of the vetting process. The use of inaccurate or false data prevents DHS from accurately screening individuals with or seeking access to high-risk chemical facilities for ties to terrorism.

Comment: Several commenters requested that the Department eliminate the requirement that facilities notify the Department when an affected individual no longer has access to a facility's restricted areas or critical assets.

Response: For the duration that an affected individual has or is seeking access to restricted areas or critical assets at high-risk chemical facilities, DHS will compare the affected individual's information against new and/or updated TSDB records. When the Department is made aware that an individual no longer has or is seeking access, that individual's information will no longer be vetted against the TSDB. Therefore, the Department will not eliminate the requirement that facilities must notify the Department when an affected individual no longer has or is seeking access to a facility's restricted areas or critical assets.

(E) DHS Solicited Comments That Respond to the Department's Interpretation of the Population Affected by RBPS-12's Background Check Requirement

Comment: Some commenters acknowledged the plain reading of CFATS, describing what categories of individuals are affected individuals for purposes of the CFATS Personnel Surety Program, while expressing their dissatisfaction that the Department was not pursuing rulemaking to modify the text of 6 CFR 27.230(a)(12). The majority of commenters, however, reiterated comments submitted during the 60-day comment period expressing disagreement with the definition of affected individuals. Commenters described the definition as a “new” CFATS requirement for escorted facility personnel and inconsistent with congressional intent, regulatory language contained in CFATS, guidance DHS has issued on RBPS satisfaction (available at http://www.dhs.gov/​xlibrary/​assets/​chemsec_​cfats_​riskbased_​performance_​standards.pdf), and with other regulatory programs designed to enhance the security of the nation's critical infrastructure. For example, some commenters mentioned that the U.S. Coast Guard permits individuals without TWICs to access the secure areas of MTSA-regulated facilities so long as those individuals are escorted. Commenters requested additional information as to why the Department has seemingly crafted new categories of affected individuals in the context of CFATS.

Response: The text of 6 CFR 27.230(a)(12) identifies who should appropriately undergo background checks as part of CFATS. The population of individuals who must be vetted under 6 CFR 27.230(a)(12) is the same as described in both the 60-day and 30-day notices: (1) Facility personnel who have or are seeking access (unescorted or otherwise) to restricted areas or critical assets, and (2) unescorted visitors who have or are seeking access to restricted areas or critical assets.^[4] In this response to comments, however, the Department has clarified that certain populations are not affected individuals. Specifically: (1) Federal officials that gain unescorted access to restricted areas or critical assets as part of the performance of their official duties are not affected individuals; (2) law enforcement officials at the State or local level that gain unescorted access to restricted areas or critical assets as part of the performance of their official duties are not affected individuals; and (3) emergency responders at the state or local level that gain unescorted access to restricted areas or critical assets during emergency situations are not affected individuals.

Comment: Some commenters suggested that the Department is selecting only one possible interpretation of 6 CFR 27.230(a)(12). Specifically, commenters suggested that a plain English interpretation of the text, “* * * appropriate background checks on and ensure appropriate credentials * * *” could mean that sometimes it is appropriate not to conduct background checks on individuals with access to restricted areas or critical assets at high-risk chemical facilities.

Response: DHS disagrees with the commenters' interpretation of 6 CFR 27.230(a)(12). That section of CFATS requires that high-risk chemical facilities perform identity checks, criminal history checks, legal authorization to work checks, and terrorist ties checks on both (1) Facility personnel with access (unescorted or otherwise) to restricted areas or critical assets, and (2) unescorted visitors with access to restricted areas or critical assets.^[5]

Comment: One commenter representing farmer-owned cooperatives explained that it is common for farmers to be unescorted in or near critical assets or restricted areas of high-risk chemical facilities when picking up products sold by or available from those facilities. The commenter stated that such a farmer would be seen at various times by various people throughout such facilities. The commenter requested clarity as to whether or not such a farmer would be an affected individual.

Response: The Department emphasizes that each high-risk chemical facility has the ability to tailor its SSP to meet its unique business and security needs, including the ability to tailor access control procedures for restricted areas and critical assets. Each high-risk chemical facility will need to consider its unique security concerns when determining which individuals will be afforded access to restricted areas or critical assets. If a farmer-owned cooperative, determined by the Department to be a high-risk chemical facility, decided to establish access controls such that an unescorted individual had access to restricted areas and critical assets within the high-risk chemical facility, then that unescorted individual's information would need to be submitted to the Department.

Comment: A few commenters requested clarity from the Department as to whether or not the scope of RBPS-12 extended beyond the physical perimeter of the high-risk chemical facility and potentially impacted individuals with access to networked computer systems.

Response: If a networked computer system is listed as a restricted area or critical asset in an approved SSP, then individuals with access to that networked computer system would be affected individuals for purposes of RBPS-12.

(F) DHS Solicited Comments Which Respond to the Statement That a Federal Law Enforcement Agency May, if Appropriate, Contact the High-Risk Chemical Facility as a Part of a Law Enforcement Investigation Into Terrorist Ties of Facility Personnel

Comment: The Department received several comments suggesting that Federal law enforcement agencies should not be hindered in their investigatory or anti-terrorism responsibilities. Most commenters believe, however, that both high-risk chemical facilities and individuals being vetted against the TSDB should, on a routine basis, be notified of TSDB vetting results.

Response: It is the policy of the U.S. Government to neither confirm nor deny an individual's status in the TSDB.

Comment: Several commenters suggested that the policy of not routinely notifying high-risk chemical facilities of vetting results is inconsistent with other Federal security vetting programs. One commenter stated that another Federal background check program provides notice to the facility and the individual when an individual has or has not cleared a background check. The commenter further stated that, “[t]his notice does not reveal to the employer facts that led the agency to disqualify the employee, but it does allow the employer the opportunity to immediately, if appropriate, remove the employee from work functions that would allow the individual to [perform sensitive work functions].”

Response: Providing a vetting result back to the facility or the individual being vetted would conflict with the U.S. Government policy to neither confirm nor deny an individual's status in the TSDB.

Comment: Several commenters requested additional information about the process and procedures the Federal Government would follow in the event that a known or suspected terrorist is identified who has or seeks access to restricted areas or critical assets at a high-risk chemical facility.

Response: DHS will not routinely notify high-risk chemical facilities of CFATS Personnel Surety Program vetting results. DHS will coordinate with Federal law enforcement entities to monitor and/or prevent situations in which known or suspected terrorists have access to high-risk chemical facilities. The precise manners in which DHS or Federal law enforcement entities could contact high-risk chemical facilities following vetting are beyond the scope of this notice.

Comment: One commenter recommended that the Department collect information on all employees who have CFATS-related adverse employment decisions, and make this information (not including personal identifiers) publically available.

Response: DHS will not collect information on employment decisions as part of the CFATS Personnel Surety Program.

(G) Respond to the Department's Intention To Collect Information That Identifies the High-risk Chemical Facilities, Restricted Areas and Critical Assets to Which Each Affected Individual Has Access

Comment: One commenter supported the Department's intention to collect information that identifies the high-risk chemical facilities to which each affected individual has access. Most commenters generally objected, however, to the Department's intention to collect information that identifies the high-risk chemical facilities to which each affected individual has access. One commenter expressed concern that the ICR indicated that the Department was collecting information about specific restricted areas or critical assets within each facility.

Response: As part of the Personnel Surety Program the Department does not intend to collect information that identifies the specific restricted areas and critical assets within high-risk chemical facilities to which each affected individual has or is seeking access.

Comment: A common objection made by commenters was that the Department was creating a tool to track individuals' movement from site to site, resulting in a program which far exceeds the Department's stated goal of identifying individuals that have ties to terrorism.

Response: DHS has no intention to and will not track the movement of affected individuals between and among high-risk chemical facilities. The Department will only require a high-risk chemical facility to submit information about an affected individual to the Department (through CSAT) for the purpose of identifying individuals with terrorist ties once. A high-risk chemical facility will not need to submit to DHS information about a single affected individual each time that affected individual accesses restricted areas or critical assets.

As mentioned previously in this notice, in accordance with the proposed submission schedule, high-risk chemical facilities will also be required to submit updated or corrected information about each affected individual, and to notify DHS when an affected individual no longer has or is seeking access to that facility's restricted areas or critical assets.

Although the Department will not track the movement of affected individuals between and among high-risk chemical facilities, the Department will associate an affected individual with the high-risk chemical facility (or facilities) for which the high-risk chemical facility Submitter providing that affected individual's information into CSAT is responsible. In the event that a Submitter enters information into CSAT on behalf of more than one facility, by default the Department will associate the affected individual with all of the facilities for which the Submitter is responsible. A Submitter may, however, modify the lists of facilities with which particular affected individuals are associated. The Department may contact the designated points of contact for particular high-risk chemical facilities for several reasons, including to identify exactly at which high-risk chemical facilities particular affected individuals have access to restricted areas or critical assets.

Comment: Commenters objected to the Department's intention to collect information that identifies high-risk chemical facilities because commenters claimed that this would cause the Department to run the risk of amassing so much information that the information collected will be meaningless.

Response: The Department disagrees. DHS requires a minimum amount of information to perform checks to determine if affected individuals have ties to terrorism, and to identify the facilities to which affected individuals have access. DHS requires this information in order to carry out the terrorist ties checks required by CFATS. DHS is confident that that it can effectively collect and maintain this information, as appropriate.

Comment: A few commenters reported that during a meeting between DHS and the Chemical Sector Coordinating Council on April 28, 2010, the Department stated its intention to collect information that identifies the high-risk chemical facilities, restricted areas, and critical assets to which each affected individual has access, and that it would use this information to conduct analysis and investigations.

Response: DHS met with the Chemical Sector Coordinating Council on April 28, 2010, and reiterated the Department's intention to collect information that identifies the high-risk chemical facilities to which each affected individual has access. The Department clarified that in the event that a match to a record in the TSDB is identified, the Department would be able to quickly identify the specific chemicals of interest (COI) the match may have access to and the contact information of the appropriate person at the chemical facility. This information may prove useful in determining an appropriate Federal, state, or local response in the event that one is necessary. The Department emphasizes that there will be no “tracking” of affected individuals, nor will DHS collect information on specific restricted areas or critical assets to which an affected individual has or is seeking access, as part of the CFATS Personnel Surety Program.

Comment: Several commenters suggested that the Department should reach out to the facility contact that submitted an individual's information to determine specifics about the individual's site access when circumstances warrant.

Response: DHS will collect information about facility points of contact in case follow-up is necessary.

(H) DHS Solicited Comments Which Respond to the Department's Intention to Seek an Exception to the Notice Requirement Under 5 CFR 1320.8(b)(3).

Comment: The Department received only a few comments in response to this question. None of these comments supported the Department's intention to seek an exception to the notice requirement under 5 CFR 1320.8(b)(3).

Response: The Department carefully reviewed the comments, but disagrees that an exception to the Paperwork Reduction Act (PRA) requirement, as contained in 5 CFR 1320.8(b)(3), that requires information collections to provide certain reasonable notices, will pose a risk to privacy. Therefore, the Department will request from OMB an exception for the CFATS Personnel Surety Program to the PRA requirement, as contained in 5 CFR 1320.8(b)(3), which requires Federal agencies to confirm that their information collections provide certain reasonable notices to affected individuals. If this exception is granted, DHS will be relieved of the potential obligation to require high-risk chemical facilities to collect signatures or other positive affirmations of these notices from affected individuals. Whether or not this exception is granted, DHS will still require high-risk facilities to affirm that, in accordance with their Site Security Plans, notice required by the Privacy Act of 1974, 5 U.S.C. 552a, has been given to affected individuals before their information is submitted to DHS.

The Department's request for an exception to the requirement under 5 CFR 1320.8(b)(3) would not exempt high-risk chemical facilities from having to adhere to applicable Federal, state, local, or tribal laws, or to regulations or policies pertaining to the privacy of facility personnel and the privacy of unescorted visitors.

(I) DHS Also Received Unsolicited Comments in Response to the 30-day Notice Related to the CFATS Personnel Surety Program

Comment: Several commenters suggested that the CFATS Personnel Surety Program outlined in the ICR exceeds the Department's statutory authority, because the proposed CFATS Personnel Surety Program design conflicts with Section 550. Commenters suggested that the CFATS Personnel Surety Program's design eliminates a high-risk facility's flexibility to achieve compliance with RBPS-12. Specifically, the commenters suggested that the CFATS Personnel Surety Program design precludes a facility from satisfying RBPS-12 by leveraging measures other than the CFATS Personnel Surety Program to identify ties to terrorism, which commenters assert is a possible violation of Section 550.

Response: The CFATS Personnel Surety Program will not exceed the Department's statutory authority, nor will it violate or conflict with Section 550. DHS will provide and approve sufficient alternative methods for facility satisfaction of the terrorism ties background check portion of RBPS-12. Specifically, the CFATS Personnel Surety Program will provide several options to high-risk chemical facilities, including the following options:

Facilities can restrict the numbers and types of persons whom they allow to access their restricted areas and critical assets, thus limiting the number of persons who will need to be vetted against the TSDB. Facilities additionally have wide latitude in how they define their restricted areas and critical assets in their SSPs, and thus are able to limit or control the numbers and types of persons requiring TSDB screening. Facilities can choose to escort visitors to restricted areas and critical assets in lieu of performing the background checks required by RBPS-12 on them. Facilities can also submit different biographic information to DHS through CSAT for affected individuals holding TWIC, HME, NEXUS, SENTRI, or FAST credentials than for affected individuals not holding such credentials.

Comment: Many commenters suggested that this ICR is improper because it makes changes to CFATS and results in de facto rulemaking. Specifically, commenters suggested that four elements of the CFATS Personnel Surety Program are changes to CFATS prescribing specific protocols for administering background checks that take a categorically different approach than all other TSDB background check programs currently administered in the United States. Those elements were: (1) The Department's plan to conduct “recurrent vetting” of affected individuals, thus requiring facilities to notify the Department when a person no longer has access to restricted areas or critical assets; (2) the Department's intention to require facilities to submit updates on an approved schedule whenever an affected individual's information has changed; (3) the possibility that the Department would not recognize TSDB vetting results completed by other Federal programs as satisfying RBPS-12's terrorist ties check requirement; and (4) the Department's intention to link each affected individual to particular high-risk chemical facilities.

Response: The ICR, and the associated 60-day and 30-day notices, do not make changes to CFATS. The ICR and associated notices provide descriptions of the nature of the CFATS Personnel Surety Program's information collection, categories of respondents, estimated burden, and costs. The PRA requires the Department to provide sufficient detail about how the Department would collect information under the CFATS Personnel Surety Program to enable the public to provide comment on that information collection.

Comment: Many commenters suggested that the Department did not properly account for Executive Order 12866 in issuing the 60- and 30-day notices preceding this notice. Among other things, Executive Order 12866 directs agencies to assess the effects of Federal regulatory actions on state, local, and tribal governments, and the private sector, and to provide qualitative and quantitative assessments of the anticipated costs and benefits of Federal mandates resulting in annual expenditures of $100,000,000 or more, including the costs and benefits to state, local, and tribal governments, and the private sector. Commenters suggested that the Department carefully consider whether the CFATS Personnel Surety Program ICR qualifies as a significant rulemaking such that it is subject to various requirements of Executive Order 12866.

Response: The Department disagrees that this information collection alone will generate expenditures in excess of $100,000,000. The Department also disagrees that this information collection constitutes rulemaking. When the Department published CFATS, however, it did consider CFATS to be a significant rulemaking. Therefore, in compliance with the requirements of Executive Order 12866, the Department outlined in the CFATS Regulatory Assessment the assumptions it used to estimate the costs of CFATS, which included the Department's estimates related to Personnel Surety in section 6.3.10 of the CFATS Regulatory Assessment.

Comment: A few commenters suggested that this information collection will have a significant economic impact on a substantial number of small entities, which requires the Department to conduct a Regulatory Flexibility Analysis in accordance with the Regulatory Flexibility Act (RFA).

Response: The RFA mandates that an agency conduct an analysis when an agency is required to publish a notice of proposed rulemaking, not when soliciting comments in preparation of submitting an ICR to OMB for review and clearance in accordance with the PRA. See 5 U.S.C. 603(a). The Department concluded in the preamble to the IFR that because Congress authorized DHS to proceed in promulgating CFATS without the traditional notice-and-comment required by the Administrative Procedure Act, the Department was not required to prepare an Initial Regulatory Flexibility Analysis (IRFA) under the Regulatory Flexibility Act. See 72 FR 17722 (Apr. 9, 2007). Even so, the Department did consider the impacts of CFATS on small entities. Specifically, the CFATS Regulatory Assessment contains the Department's analysis of the impacts of CFATS on small entities. After consideration of the percentage of small entities that may have to comply with the risk-based performance standards (which include background checks under the CFATS Personnel Surety Program) required by CFATS and the compliance costs explained in the CFATS Regulatory Assessment, the Department determined that CFATS may have a significant economic impact on a substantial number of small entities.

Comment: One commenter requested that the Department remove administrative roadblocks that either complicate the CFATS Personnel Surety Program or prohibit measures that would simplify and enhance the CFATS Personnel Surety Program. Specifically, the commenter requested that the Department allow employees to apply for TWICs, if their individual jobs require them to have access to restricted areas or critical assets at high-risk chemical facilities. The commentor suggested that there is no language in MTSA that expressly prohibits the use of TWICs at non-maritime facilities.

Response: TWIC's authorizing statute, the Maritime Transportation Security Act of 2002 (MTSA), as amended, 46 U.S.C. 70101 et seq., explicitly applies “transportation security card” requirements to: “individual[s] allowed unescorted access to secure area[s] designated in * * * [maritime] vessel or [maritime] facility security plan[s]” (70105(b)(2)(A)); certain MTSA license and permit holders (70105(b)(2)(B)); maritime vessel pilots (70105(b)(2)(C)); maritime towing vessel personnel (70105(b)(2)(D)); individuals with access to certain protected maritime security information (70105(b)(2)(E)); and certain other individuals (70105(b)(2)(F)-(G)). Further, individuals are eligible to receive a TWIC unless, among other criteria, they have committed certain “disqualifying criminal offense[s],” or do not meet certain “immigration status requirements.” 49 CFR 1572.5(a)(1)-(2). The CFATS authorizing statute, however, applies to “chemical facilities that * * * present high levels of security risk.” Department of Homeland Security Appropriations Act of 2007, Pub. L. 109-295, 550 (Oct. 4, 2006). CFATS “does not apply to facilities regulated pursuant to the Maritime Transportation Security Act of 2002.” 6 CFR 27.110(b). CFATS Personnel Surety Program screening requirements apply only to high-risk chemical facilities' “personnel, and as appropriate * * * unescorted visitors with access to restricted areas or critical assets.” 6 CFR 27.230(a)(12). Individuals are not eligible for TWICs solely because they have access to high-risk chemical facilities covered by CFATS. Accordingly, the CFATS Personnel Surety Program is not duplicative with the TWIC program in terms of type of facilities covered or program objectives.

High-risk chemical facilities may, however, choose to leverage TWIC credentials as part of the identity, legal authorization to work, and criminal history background checks they perform under CFATS. See 6 CFR 27.230(a)(12)(i)-(iii). The precise manners in which high-risk chemical facilities could leverage TWIC credentials as part of identity, legal authorization to work, and criminal history background checks could vary from facility to facility, and should be described in individual facilities' SSPs.

Comment: Several commenters suggested that collecting sufficient information to conduct the background checks required by RBPS-12 might cause high-risk chemical facilities to violate State privacy laws and/or the Fair Credit Reporting Act, 15 U.S.C. 1681 et seq.

Response: The Department does not agree that participation in the CFATS Personnel Surety Program will cause high-risk chemical facilities to violate the Fair Credit Reporting Act. Similarly, the Department does not agree that participation in the CFATS Personnel Surety Program will cause high-risk chemical facilities to violate State law.

High-risk chemical facilities may conduct the identity, legal authorization to work, and criminal history background checks required by 6 CFR 27.230(a)(12)(i)-(iii) in a variety of ways. Although identity, legal authorization to work, and criminal history background checks are not the subject of this notice, the Department believes that high-risk chemical facilities can structure and carry out these background checks in compliance with all applicable Federal and state laws, including the Fair Credit Reporting Act and state privacy laws.

Comment: One commenter stated that screening databases and watchlists should be publicly accessible to allow for efficient and consistent background checks. The commenter stated that other U.S. and partner nation agencies share this information in the public domain, which allows for regulated entities to engage third-party vendors to facilitate background screening. The commenter cited specifically Office of Foreign Assets Control watch lists, which are available to the public.

Response: The Department does not agree that the TSDB should be publicly available. The TSDB is the U.S. government's consolidated and integrated terrorist watchlist, used to identify known or suspected terrorists, containing sensitive information not appropriate for public consumption.

The TSDB remains an effective tool in the government's counterterrorism efforts because its contents are not disclosed. For example, if it was revealed who was in the TSDB, terrorist organizations would be able to circumvent the purpose of the terrorist watchlist by determining in advance which of their members are likely to be questioned or detained.

Comment: One commenter stated that there is no central database that covered entities could query to validate that an already-existing background screening may be on file with the Department.

Response: DHS agrees that there is currently no central database that allows the public to determine that an individual has already undergone screening by the Department.

Comment: One commenter was troubled by the information pertaining to RBPS-12 contained in Appendix C of the May 2009 Risk-Based Performance Standards Guidance (http://www.dhs.gov/​xlibrary/​assets/​chemsec_​cfats_​riskbased_​performance_​standards.pdf), because the commenter believes that certain types of measures, procedures, policies, and plans mentioned in Appendix C are not appropriate for determining if chemical facility personnel are terrorist threats.

Response: The Department expects high-risk chemical facilities to implement appropriate security measures to conduct identity, criminal history, and legal authorization to work background checks. These security measures can vary from facility to facility commensurate with facility-specific risks, security issues, and business practices. The guidance referenced by the commenter (see pages 180 to 186 of the Risk-Based Performance Standards Guidance), and other guidance addressing identity, criminal history, and legal authorization to work background checks, however, is not guidance addressing compliance with 6 CFR 27.230(a)(12)(iv), and as such is not the subject of this notice, nor is it the subject of the underlying ICR or of the 30- or 60-day notices preceding this notice.

Comment: One commenter requested that the Department clarify what appeal or waiver options an affected individual has if his/her employer takes an adverse employment action against him/her based on RBPS-12 background checks or based on information received or obtained under the CFATS Personnel Surety Program. The commenter also requested that the Department prevent high-risk chemical facilities from using personal information collected from affected individuals as part of RBPS-12 for purposes other than conducting the background checks required by RBPS-12.

Response: High risk chemical facilities' employment actions are not regulated by CFATS.

The ICR the Department will submit to OMB, this notice, the 60-day notice, and the 30-day notice address the CFATS Personnel Surety Program, not the identity, legal authorization to work, and criminal history background checks required by 6 CFR 230(a)(12)(i)-(iii). Discussion of information collected as part of those other three background checks, or employment decisions based on them, is beyond the scope of this notice.

Conclusion

As mentioned in the summary section of this notice, DHS has submitted an ICR to OMB for review and clearance in accordance with the Paperwork Reduction Act of 1995. This notice responds to comments received during the 30-day notice.

Prior to implementation of the CFATS Personnel Surety Program, the Department will also publish a Privacy Impact Assessment (PIA) about the CFATS Personnel Surety Program, available on the Department's Web page at http://www.dhs.gov/​privacy and http://www.dhs.gov/​chemicalsecurity. The Department will also publish a System of Records Notice (SORN) for the CFATS Personnel Surety Program, and a Notice of Proposed Rulemaking proposing to take certain Privacy Act exemptions for the CFATS Personnel Surety Program System of Records.

The Department will also publish a notice, and/or send notice to high-risk chemical facilities individually, stating that the CFATS Personnel Surety Program has been implemented. In that notice, the Department will include description of how the CFATS Personnel Surety Program will be implemented, as well as the information submission schedule high-risk chemical facilities will be required to follow. The notice will also describe how a high-risk chemical facility can request a variance from the submission schedule.

Analysis

Agency: Department of Homeland Security, National Protection and Programs Directorate, Office of Infrastructure Protection, Infrastructure Security Compliance Division.

Title: CFATS Personnel Surety Program.

Form: DHS Form 11000-29.

OMB Number: 1670-NEW.

Frequency: As required by a DHS-approved schedule.

Affected Public: High-risk chemical facilities as defined in 6 CFR Part 27, high-risk chemical facility personnel, and as appropriate, unescorted visitors with access to restricted areas or critical assets.

Number of Respondents: 1,303,700 individuals.

Estimated Time per Respondent: 0.54 hours (32.4 minutes).

Total Burden Hours: 707,200 annual burden hours.

Total Burden Cost (capital/startup): $0.00.

Total Burden Cost (operating/maintaining): $29,704,000.

Signed: June 6, 2011.

David Epperson,

Chief Information Officer, National Protection and Programs Directorate, Department of Homeland Security.

Footnotes

1.  Individual high-risk facilities may classify particular contractors or categories of contractors either as “facility personnel” or as “visitors.” This determination should be a facility-specific determination, and should be based on facility security, operational requirements, and business practices.

2.  The estimate of 3,189,600 affected individuals is derived from [(354,000 affected individuals x 10)—354,400 affected individuals]

3.  The average hourly wage rate previously used by the Department in the 30-day and 60-day notices was $84. This average hourly wage rate was based upon the hourly wage rate estimate for Site Security Officers (SSO) contained in section 6.3.1 of the CFATS Regulatory Assessment, adjusted to account for passage of time since publication of the Regulatory Assessment. See CFATS Regulatory Assessment (Apr. 1, 2007), http://www.regulations.gov/​#!documentDetail;​D=​DHS-2006-0073-0116.

4.  See footnote 1.

5.  See footnote 1.