Remarks by Homeland Security Secretary Michael Chertoff at the 2007 Chemical Sector Security Summit

Falls Church, Va.
2007 Chemical Sector Security Summit

Secretary Chertoff: Thank you for that kind introduction. I want to say we have a number of people from DHS here. I won’t acknowledge them all but I do want to welcome Robert Jamison, who is our Acting Under Secretary for the National Protection & Programs Directorate of DHS, and also Bob Stephan, who is the Assistant Secretary for Infrastructure Production. I know you have worked particularly with Bob and his staff for a very long period of time.

In the run-up to what we have issued with respect to our chemical security regulations, this is a tremendous first step in securing critical infrastructure and protecting the country by working in partnership with one of the most important groups of industries in the economy, the chemical sector in the economy.

And so I’m delighted to be here with my colleagues and with my industry partners to talk about how we can continue to protect our nation’s chemical sector and ensure that this vital part of our economy continues to flourish.

I would also like to thank in particular the Chemical Sector Coordinating Council for convening this summit and for working with our Department to enhance protection of chemical sites and facilities all across the country.

The most recent manifestation of this was our work to finalize and release the chemical sector’s specific plan as part of our national infrastructure protection plan, which is our common framework for managing risk to our nation’s critical infrastructure, all 17 elements of it, including of course the chemical sector.

Getting this work and this planning done, although not the kind of activity that lends itself to a sound byte or a bumper sticker, actually reflects the achievement of a major milestone in homeland security, and all of you who contributed to the development of the plan deserve a great deal of thanks. It may be that people don’t appreciate the value of this until we avert something or minimize something that could potentially cause loss of hundreds of thousands of lives and tremendous damage to our economy.

More generally, I’d like to thank the industry for your working with us in partnership, protecting the chemical sector not only from terrorist attacks, but dealing with hurricanes, natural disasters and unexpected emergencies. You know, we always come back to this fundamental point. The federal government, in fact state and local government, do not own chemical plants. We do not employ workers in chemical facilities.

Therefore, it is the industry that owns, operates and employs those who work in the chemical sector that have to be the critical players in securing your assets and your employees against a man-made or a natural disaster. That’s why we look to you to work with us to develop the plans and implement the measures that will ultimately allow us to raise the level of security for the American people.

And, of course, although I’ve mentioned state and local government, I want to emphasize again that as the first responders, the state and local governments have to be intimately bound up with our planning processes and our rulemaking with respect to the chemical sector. It is the role of first responders in helping us prevent, protect against and recover from incidents that really reflects the front line with respect to homeland security in all sectors of the economy, but particularly with the chemical sector.

So let me talk a little bit about our overall goals and then how we’re going to go about meeting them under the plans and protocols we’re talking about here today.

Well, let me begin by saying that in this area, as with every other area, we have to take a risk-based approach to protecting the chemical sector. That means we evaluate different sites, different facilities and different chemicals in terms of their different levels of risk. And, therefore, we assign different levels of protection to each of them. Olive oil and chlorine do not reflect the same level of risk. Therefore, we’re not going to protect plants that process olive oil in the same way we’re going to protect plants that process chlorine.

And that recognition of different risk is at the cornerstone of what we do with all of our strategies and all of our plans. We don’t want to over-regulate. We don’t want to cripple legitimate commerce. We don’t want to dampen a legitimate innovation simply in order to create an illusory sense of security. But where we do have high-risk chemical plants, measured in terms of consequence of an attack or a spill, or a theft, vulnerability of the plant and threat in terms of intent and capability, then we do have to make sure that those high-risk facilities are being adequately protected and that owners and operators across the sector are doing their part.

So this is the key to what I call smart regulation. We have to use a combination of incentives, carrots, and sometimes some sticks, to make sure that we get the job done, and that’s going to be our philosophy moving forward.

A second principle is that we have to approach this challenge comprehensively. That means we can’t just look at what happens to be on the news in a given day and run out and say we’re going to fix that problem. We’ve got to look at the problem across the entire spectrum of the economy and make sure that when we build protections we’re building them up in a synchronized manner that addresses all of the vulnerabilities, not merely those that happen to capture the attention on yesterday’s news.

So, for example, although this particular summit is focused on our regulation of chemical sites and facilities, we have also been very attentive to the need to secure chemicals when they are in transit between fixed facilities or when they are in our ports and therefore subject to regulation by the Coast Guard as opposed to land-based chemical facilities.

We want to make sure our approach covers all of these different vulnerabilities so that we’re not leaving gaps based upon the bureaucratic happenstance of which agency has the authority. That’s one of the values of DHS. We get to stand back and look at all of the security regulation across the board and make sure that we’re looking to avoid any seams or breaks in continuity that could create a vulnerability that would be exploited by a terrorist.

As part of the comprehensive approach, last December we put forward a proposed regulation to reduce the stand still time for rail cars that are carrying toxic inhalation hazards, so-called TIH chemicals, around our majority cities. This was a risk-based analysis. You know, people are out there talking about how dangerous it would be if someone blew up a car, a rail car carrying toxic chemicals, but people are not necessarily analyzing where that risk was the greatest.

We mapped the system in coordination with our local partners, and we identified that the greatest vulnerability is in those areas where you have the chemical sitting still in a rail yard or in some particular location of track, or in an area where there’s a handoff between one entity controlling the chemical car and another one, and somehow no one has responsibility during that handoff period. We recognize that’s the period of maximum vulnerability, and so that’s where we directed our regulatory attention.

Our regulation with respect to these chemicals in transit formalized a set of agreements that we’ve reached with rail carriers to make sure that the relatively small number of cars that carry these dangerous chemicals on a given day are never left unattended; that they can be tracked in real time in case there is a threat or an emergency; that they are incentivized to take the safest and most economically practicable route; and that we minimize the amount of time that there is a standstill when the vulnerability is the greatest.

This is risk management in action. Targeting the highest risk chemicals, looking first and foremost at those areas where there’s the greatest vulnerability, and then working with those who understand the system the best to reduce those vulnerabilities without getting to the point that we actually make it impossible to ship the chemicals, which would then of course cause a whole new set of hazards and problems.

This emphasizes our third major philosophical approach to this kind of regulation, which is making sure that we are always working as partners. No matter how good our intentions are here in Washington, we simply can’t know enough about each of the individual variations in chemical plants and chemical types all across the country to run regulation and to incentivize people properly as a command-and-control exercise where bureaucrats in Washington decide how the whole country ought to organize itself.

We need to share knowledge, information and intelligence about threats and vulnerabilities with our partners and our state and local officials across this entire sector. We need to network, where we can take the benefit of your constant learning of new risks and constant learning of new techniques to reduce vulnerability, and then we need to be able to disseminate that out and to incorporate that into our rulemaking and regulatory process.

Now I do recognize that we have variables in the way people deal with these issues in their own particular chemical facilities. Many, many facilities are secure. Some are not secure, and others fall kind of in the middle between being well secured and not secured at all.

Many, in fact I’d venture to say most chemical plant operators, understand the wisdom and the self-interest that ought to motivate them to make the necessary investments to secure their plants and their plant workers against the possibility of an attack from terrorists.

But there are always those who do not get the message or are not responsible. And that’s why we need to make sure that we implement the fourth element of our philosophy, which is to build a system of regulation that assures we don’t have what the economists call “free riders,” people who don’t make the required investment because what they’re hoping to do is piggyback on the investment that others make and hide among the well invested companies in order to try to get protection on the cheap.

We do need to make sure everybody carries their far share. And by the way, this is of great importance to those of you who have made the investment, and who have spent the money, because you’re entitled not to have a competitive disadvantage by those who are less responsible and try to save money on those kinds of investments in security that are necessary to protect all Americans.

So, while we want to work to properly recognize and incorporate the elements of investment that have already been undertaken, we do need to make sure we have established some basic requirements so that everybody makes the investment that is required at a minimum to protect this country. And of course, we need to have the capability for those who don’t get the message with the carrots to apply a little bit of stick, and we will not hesitate to do that.

So how are we going to implement these four elements of our philosophy on regulation of the chemical sector? Well, as you know, we published an interim final chemical facility security rule in early April. Let me pause for a moment to comment on that phrase, “interim final rule.” Only in Washington could –

That’s like jumbo shrimp, you know, it just doesn’t – but nevertheless, there actually is a whole body of law that describes these things as interim final rules, so I’m obliged to use the term. But we did put this rule out in early April. And as of June 8th, we now have the ability and the authority to enforce that regulation that we issued in April, which for the first time sets national standards for chemical security.

So let me talk about this regulation and how we are actually going to implement it over the next couple of months. First, the cornerstone of our regulation, and this is in keeping with our philosophy or risk management, is to determine which plants and facilities pose the greatest risk across the sector. Once we identify those, we can then put in the appropriate measures based on the appropriate level of risk.

And as I’ve said before, risk is a combination of threat, vulnerability and consequence. So we’re looking at the kinds and quantities of chemicals at particular facilities, the vulnerabilities that could be exploited to do harm to the facility, and perhaps most important, the potential consequences to human life and our economy if in fact there were a successful exploitation of any vulnerabilities.

In the end, consequence is kind of the basic driver of how we triage and how we align the various levels of risk across the sector. So to help us define this universe of risk in partnership we’re going to ask plants and facilities across the country to register online and complete a tool that we call a top screen, which is an online assessment that allows us to determine whether you should be covered by the regulation and to what extent the regulation ought to cover you.

Now, the fact that you complete the assessment doesn’t mean you’re going to be regulated. There may be many facilities that complete an assessment that show that they really don’t need to be regulated because there really isn’t a high consequence outcome that we need to be worried about. But we will need to look at all of these assessments so that we can develop a picture of risk across the entire country, and thereby focus on those plants and facilities that we need to be most concerned about.

Now some may ask the question, well, aren’t you relying upon the chemical plants themselves to furnish the information which you’re going to evaluate? And that’s true. That’s the essence of a partnership. We’re requiring that the chemical plants input the information. Obviously, you’ve got to do it truthfully. It’s like your tax returns, you know. If you file false tax returns, you get punished. If you file false assessments, you get punished.

But we assume that the vast majority of facilities are going to do the right thing. They’re going to put the facts in, and we will be able then to complete this assessment.

Now once we’ve got this top screen we need to define for you what are the kinds and quantities of chemicals that are going to qualify a facility to be regulated. We took at first cut at this in April when we released a proposed list of chemicals as part of this interim final rule. This was designed to get feedback so that we could see what your reactions were.

We did get about 4,200 comments on this list, and I’d like to thank those of you who provided this feedback. I might observe that the propane industry submitted the vast majority of these comments. We were able to meet with members of the industry and obtain some helpful suggestions about threshold quantities.

Obviously, we are going to treat propane as something that above a certain quantity we have to be concerned about because the fact is, propane can be used as an explosive. And we don’t want to discover for the first time how it can be used here in the United States. We want to anticipate this and build in the protections in advance.

We’re going to consider all of the input we have received and all of the comments we’ve received as we put Appendix A, which is the list of chemicals, into final form. The key is to have a list that takes account of real world experience, is not unduly burdensome, but I also have to caution you, recognizes that there are chemicals out there which could be made into improvised explosive devices, and we need to make sure those are not vulnerable to either attack at their location or to theft.

From the date that our finalized list of chemicals of concern and the threshold quantities are published in the Federal Register, and we expect this to happen within a matter of a few weeks, affected facilities that quality for regulation will have 60 days to provide information for our risk assessment process. And then we’ll evaluate those submissions to determine which facilities actually have to be regulated and which are the highest risk that we need to evaluate first.

I should observe at this point that as comprehensive as we’re trying to be, there remains one gap in our system of regulation, and that has to do with certain kinds of chemicals that are held at water treatment plants and wastewater plants. When the chemical security bill was passed through Congress, this particular slice was exempted by Congress. We do not regulate it.

Nevertheless, we have reached out to the industry and asked them voluntarily to take a hard look at the security measures that they’re putting in place there. We may not at this point have the authority to regulate them, but at a minimum we can set out, and we’ve communicated this, the kinds of standards that these wastewater and water treatment plans should put into effect to make sure that these dangerous chemicals they have on site are not stolen. Because again, unfortunately, if you look over to Iraq, you’re going to see these kinds of chemicals wind up in improvised explosive devices.

And so I don’t want – for those of you who are not subject to regulation, I don’t want you to breathe a sigh of relief like we’re off the hook. You’re on the hook, because you’re going to have to do this yourselves until the time comes along that regulatory authority to address these is given to us or to some other agency.

And I don’t need to tell you the consequences of ignoring a clear warning about securing dangerous chemicals. Wholly apart from regulation, the consequences could be severe, and I’m quite sure those of you who have lawyers, and you probably all do, can ask your lawyers to develop a very vivid picture of what life would be like if it turned out someone who was unregulated was nevertheless negligent with respect to securing these dangerous chemicals. Enough said.

Now, in addition to the general regulatory process I’ve described for you, I do want to say that we’re going to not wait for the 60 days to get rolling on raising the level of chemical security. We’re going to begin in the very, very near future reaching out to a select number of facilities – we may start this at the end of this week – that we already know are going to fall within the highest-risk tier category in terms of threat, vulnerability and consequence.

And that’s because we have been doing a lot of work with the industry, and I think we know and you probably know what the highest-risk facilities are. These facilities really are going to be required to register online almost immediately and begin that top screen process even before the regulatory 60 days has been concluded.

Once we publish the final list of chemicals and threshold quantities, chemical facilities beyond those that we are contacting in the next week or so will then have to review the list themselves and determine on their own whether they meet the requirement for the top screen.

And since the tool is now online, any facility that anticipates it’s likely to be required to register might want to jump the gun and begin the process of registering and completing this analytic tool even before the 60 days are up. This will help us expedite risk analysis and it’s also going to help you because it will give a little bit of advance guidance about the kinds of investments you’re going to have to make at the end of the day to comply with these regulations.

You may discover that you don’t need to be regulated, and maybe that will be an early piece of good news. But for those who do have to be regulated, what we offer you is clear guidance that you can rely upon. It’s been my experience in the private sector that clarity is the most valued element of any regulatory scheme. And if you know in advance what you’re going to be required to do and how to do it, I know you all are capable of getting it done.

To help you prepare and to evaluate your vulnerability assessments and your site security plans we will tell you where there are gaps and we’ll give you guidance as to how to fill them. We will go out and visit to help you work to raise your level of security.

At the end of the day that’s a win-win. It makes your security better, probably keeps your insurance premiums down, and most important from my standpoint, it provides safety and security to the communities that surround your chemical plants, communities in which you yourselves may live and many of your employees also live and have their children go to school.

We’re going to be careful also to emphasize that these federal plans are not meant to willy-nilly preempt your local state and local ordinances and laws, which are directed at public health and safety. We do not expect to preempt any of these state and local laws unless they actually interfere with our ability to implement the rules.

So this is not meant to tell state and locals that they should go away from the field. Rather, obviously, they’ll want to work with us to make sure that anything they do is synchronized and not interfering, but we are not seeking a broad-based preemption here.

Finally, let me talk a little bit about the kinds of performance standards we’re going to be requiring under this regulation, because one of the cardinal principles we’ve articulated at the very beginning is we’re not going to micromanage and say you have to build this barrier here and you have to have, you know, people wear this kind of uniform and have this kind of gun. That’s micromanagement. Your job is to implement. Our job is to set the performance standards.

So what we’re going to be talking about are how long and how effectively you can secure a perimeter at a facility; how effectively you can control access; what means you have to deter and prevent theft of dangerous chemicals; and how you prevent internal sabotage.

We will give you the ability to tailor your particular plan to meet these objectives. All we require is that you have to meet the objective and you have to be able to show that you are capable of securing these various avenues to terrorist sabotage in a way that satisfies us that the metrics have been achieved.

We will be happy to give you technical assistance. It’s not going to be a one-strike-and-you’re-out type of deal, but if we have to go back and forth in a process of developing a methodology that will allow you to meet the performance standards, that’s what we’re going to do. We don’t want anybody to fail here. We want to work with you to achieve success.

Let me conclude by saying this. I know that the vast majority of people in this business are by culture and by training very attuned to doing the right thing – making sure you don’t endanger your communities, making sure you don’t endanger your employees, and making sure you don’t endanger your ongoing businesses. So I have little doubt that the vast majority of people are going to comply energetically and in good faith. But my experience, and hopefully it’s not colored too much by having been a prosecutor, is that every once in a while you do find some people who think they’re going to cut corners. And, therefore, I do need to make it clear that we will hold everybody accountable. And this is of course to the great benefit of the law abiding because it assures that people can’t get a competitive advantage by cheating on necessary security regulations.

As everybody knows, those facilities that at the end of the day fail to meet performance standards, could face penalties of up to $25,000 for each day a violation occurs, or they could be ordered to halt operations unless security is brought up to the level that we feel is necessary.

I’m confident we’ll never get to that with most of you. But for those who are tempted to game the system, don’t be under any illusions. I’m sure nobody in this room is in that category. For those out in the audience who may feel that spending on security is a low priority, believe me when I say, we will take very seriously accountability and our ability to put in sanctions if necessary to spur and incentivize performance.

All of us bear the responsibility for securing the homeland and nowhere is that more true than in the area of chemical facilities, which, for all the benefit they bring to us, also have a significant level of risk and can be adapted for bad purposes.

We will continue to work together with you in an ongoing fashion to come up with the best and most effective and most cost effective measures to strengthen the security of our chemical facilities while not undercutting this vital area of the economy.

We look forward to working with you in implementing the rule so that we operate in a balanced, risk-managed way and that we continue to talk to one another through the sector-specific planning process and the national infrastructure protection planning process.

We have made a lot of progress since this got on the radar screen and particularly since Congress gave us the authority to move ahead. This particular sector of the economy has been tremendous in stepping up to the plate and working with us to get the public a plan that is effective, that is comprehensive, and that has been put together with quite a bit of speed. And I think that that’s something that we all owe you a debt of thanks for.

Our reward is going to come in the fact that we are deterring and preventing attacks on the chemical facility. For those who sometimes think this is just a bureaucratic exercise, I want you to picture what I call the day after.

Picture the day after someone does attack a plant and blows it up and there’s a chemical toxic inhalation plume or a giant fireball that has killed dozens of people or more, or when someone hijacks and steals chemicals and they wind up in an improvised explosive device. The day after that everybody is going to be examining their consciences and saying have we done everything reasonably possible to prevent this from happening?

This kind of summit where we all come together, we lay down standards, and we commit to getting the job done is the way you square your conscience. And that’s ultimately what this is about for everybody in my Department and I think it’s true for everybody in the chemical sector, most particularly those who have the responsibility for security and for overall management.

So, thank you for spending a very nice day here in Washington inside a windowless large room.

I appreciate the commitment that you show in your attentiveness. We look forward to continuing this great partnership and thank you for your hard work, and we look forward to further hard work as we continue to elevate security for this country.

Thank you and God Bless.