National Protection and Programs Directorate; Chemical Facility Anti-Terrorism Standards Personnel Surety Program, 18850-18857 [2010-8312]

Agencies

• DEPARTMENT OF HOMELAND SECURITY

[Federal Register Volume 75, Number 70 (Tuesday, April 13, 2010)]
[Notices]
[Pages 18850-18857]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: 2010-8312]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF HOMELAND SECURITY

[Docket No. DHS-2009-0026]


National Protection and Programs Directorate; Chemical Facility 
Anti-Terrorism Standards Personnel Surety Program

AGENCY: National Protection and Programs Directorate, DHS.

ACTION: 30-day notice and request for comments: New information 
collection request 1670-NEW.

-----------------------------------------------------------------------

SUMMARY: The Department of Homeland Security (DHS), National Protection 
and Programs Directorate (NPPD), Office of Infrastructure Protection 
(IP), Infrastructure Security Compliance Division (ISCD) will be 
submitting the following information collection request (ICR) to the 
Office of Management and Budget (OMB) for review and clearance in 
accordance with the Paperwork Reduction Act of 1995 (PRA). The 
information collection is a new information collection. A 60-day public 
notice for comments was previously published in the Federal Register on 
June 10, 2009, at 74 FR 27555. Comments were received and responses are 
in this notice. The purpose of this notice is to solicit additional 
comments during a 30-day public comment period prior to the submission 
of this collection to OMB. The submission describes the nature of the 
information collection, the categories of respondents, the estimated 
burden, and cost.

DATES: Comments are encouraged and will be accepted until May 13, 2010. 
This process is conducted in accordance with 5 CFR 1320.8.

ADDRESSES: Interested persons are invited to submit comments on the 
proposed information collection through the Federal Rulemaking Portal 
at https://www.regulations.gov. Follow the instructions for submitting 
comments. Comments must be identified by docket number DHS-2009-0026.
    Comments that include trade secrets, confidential commercial or 
financial information, Chemical-terrorism Vulnerability Information 
(CVI), Sensitive Security Information (SSI), or Protected Critical 
Infrastructure Information (PCII) should not be submitted to the public 
regulatory docket. Please submit such comments separately from other 
comments in response to this notice. Comments containing trade secrets, 
confidential commercial or financial information, CVI, SSI, or PCII 
should be appropriately marked and submitted by mail to the DHS/NPPD/
IP/ISCD CFATS Program Manager at the Department of Homeland Security, 
245 Murray Lane, SW., Mail Stop 0610, Arlington, VA 20528-0610. 
Comments must be identified by docket number DHS-2009-0026.

FOR FURTHER INFORMATION CONTACT: A copy of this ICR, with applicable 
supporting documentation, may be obtained through the Federal 
Rulemaking Portal at https://www.regulations.gov.

SUPPLEMENTARY INFORMATION:

Program Description

    The Chemical Facility Anti-Terrorism Standards (CFATS), 6 CFR part 
27, require high-risk chemical facilities to submit information about 
facility personnel and, as appropriate, unescorted visitors with access 
to restricted areas or critical assets at those facilities. This 
information will be vetted by the Federal Government against the 
Terrorist Screening Database (TSDB), the consolidated and integrated 
terrorist watchlist maintained by the Federal Government, to identify 
known or suspected terrorists (i.e., individuals with terrorist ties).

[[Page 18851]]

    High-risk chemical facilities must also perform other relevant 
background checks in compliance with CFATS Personnel Surety Risk-Based 
Performance Standard 12 (RBPS-12). See 6 CFR 27.230(a)(12)(i-iii): 
High-risk chemical facilities must ``perform appropriate background 
checks * * * including (i) Measures designed to verify and validate 
identity; (ii) Measures designed to check criminal history; [and] (iii) 
Measures designed to verify and validate legal authorization to work.'' 
The CFATS Personnel Surety Program is not intended to halt, hinder, or 
replace high-risk chemical facilities' performance of background checks 
which are currently required for employment or access to secure areas 
of those facilities.

Background

    On October 4, 2006, the President signed the Department of Homeland 
Security Appropriations Act of 2007 (the Act), Public Law 109-295. 
Section 550 of the Act provides DHS with the authority to regulate the 
security of high-risk chemical facilities.
    Section 550 requires that DHS regulations establish CFATS RBPS. 
RBPS-12 (6 CFR 27.230(a)(12)(iv)) requires that regulated chemical 
facilities implement ``measures designed to identify people with 
terrorist ties.'' The ability to identify individuals with terrorist 
ties requires the use of information held in Government-maintained 
databases, which are unavailable to high-risk chemical facilities. 
Therefore, DHS is implementing the CFATS Personnel Surety Program, 
which will allow chemical facilities to comply with RBPS-12 by 
implementing ``measures designed to identify people with terrorist 
ties.''

Overview of CFATS Personnel Surety Process

    The CFATS Personnel Surety Program will work with the DHS 
Transportation Security Administration (TSA) to identify individuals 
who have terrorist ties by comparing information submitted by each 
high-risk chemical facility to the information of known or suspected 
terrorists who are listed in the TSDB.
    Information will be submitted to DHS through the Chemical Security 
Assessment Tool (CSAT), the online data collection portal for CFATS. 
The representative(s) of each high-risk chemical facility will submit 
the information of affected individuals to DHS through CSAT. The 
representative(s) of each high-risk chemical facility will also certify 
that the information is (1) true, correct, and complete, and (2) 
collected and submitted in compliance with the facility's Site Security 
Plan (SSP). The representative(s) of each high-risk chemical facility 
will also affirm that notice required by the Privacy Act of 1974, 5 
U.S.C. 552a, has been given to affected individuals before their 
information is submitted to DHS.
    DHS will send a verification of submission to the representative(s) 
of each high-risk chemical facility when a high-risk chemical facility 
(1) Submits information about an affected individual for the first 
time, (2) submits updated or corrected information about an affected 
individual, and/or (3) notifies DHS that an affected individual no 
longer has access to that facility's restricted areas or critical 
assets.
    Upon receipt of each affected individual's information in CSAT, DHS 
will send a copy of the information to TSA. Within TSA, the Office of 
Transportation Threat Assessment and Credentialing (TTAC) conducts 
screening and vetting of information against the TSDB for many DHS 
programs. On behalf of DHS, TTAC will compare the information of 
affected individuals collected by DHS to the information of known or 
suspected terrorists on the TSDB. TTAC will forward the results from 
potential matches to the Federal Bureau of Investigation's Terrorist 
Screening Center (TSC), which will make a final determination of 
whether an individual is a match to a known or suspected terrorist 
listed in the TSDB.
    In the event that there is a positive match to an identity in the 
TSDB, the TSC will notify the appropriate Federal law enforcement 
agency for coordination, investigative action, and/or response, as 
appropriate. DHS will neither routinely provide vetting results to 
high-risk chemical facilities, nor will it provide results to an 
affected individual whose information was submitted by a high-risk 
chemical facility. As warranted, high-risk chemical facilities may be 
contacted by the Department or Federal law enforcement as a part of 
appropriate law enforcement investigation activity. (See the amendment 
to the FBI's Terrorist Screening Records System, published in the 
Federal Register on August 22, 2007, at 72 FR 47073.)

Information Collected

    DHS may collect the following information from individuals:

 Full name
 Date of birth
 Place of birth
 Gender
 Citizenship
 Passport information
 Visa information
 Alien registration number
 DHS Redress Number (if available)
 Work phone number(s)
 Work e-mail address(es)

    DHS will collect information that identifies the high-risk chemical 
facility or facilities, to which the affected individual has access to 
restricted areas or critical assets. As applicable, DHS will also 
collect information to verify that an affected individual is currently 
enrolled in a DHS program which relies on DHS-performed TSDB checks, in 
addition to other program-specific requirements.
    DHS may request additional information on an affected individual to 
confirm that the individual is or is not a match to a known or 
suspected terrorist in the TSDB. DHS may randomly select a small 
percentage of affected individuals for further verification as part of 
data accuracy review and auditing processes. In order to assist with 
this confirmation and verification, DHS may request additional 
information on affected individuals from the high-risk chemical 
facilities which have submitted their information to the Department. 
DHS may also collect information about points of contact at each high-
risk chemical facility, and which points of contact the Department or 
Federal law enforcement personnel may contact with follow-up questions. 
However, a request for additional information from DHS does not imply, 
and should not be construed to indicate, that an individual is known or 
suspected to be associated with terrorism.
    DHS may collect information on affected individuals as necessary to 
enable it to provide redress for individuals who believe that they have 
been improperly impacted by the Personnel Surety Program. The 
information collected may include information necessary to conduct 
adjudications under subpart C of CFATS, 6 CFR 27.300-27.345.
    DHS will also collect administrative or programmatic information 
(e.g., affirmations or certifications of compliance, extension 
requests, brief surveys for process improvement, etc.) necessary to 
manage the CFATS Personnel Surety Program.

Affected Population

    6 CFR 27.230(a)(12) requires facility personnel and, as 
appropriate, unescorted visitors who have access to restricted areas or 
critical assets to undergo background checks. This affected population 
will include (1)

[[Page 18852]]

facility personnel (e.g., employees and contractors) who have access, 
either unescorted or otherwise, to restricted areas or critical assets, 
and (2) unescorted visitors who have access to restricted areas or 
critical assets.
    These background checks do not affect facility personnel who do not 
have access to facilities' restricted areas or critical assets, nor do 
they affect escorted visitors.

Linking Affected Individuals to Specific CFATS Covered Facilities

    To comply with CFATS, high-risk chemical facilities are required to 
identify who is an affected individual, and at which high-risk chemical 
facility or facilities each affected individual has access to 
restricted areas or critical assets. DHS intends to collect this 
information through CSAT.

Personnel Surety Submission Schedule To Check for Terrorist Ties

    DHS will establish a CFATS Personnel Surety Submission schedule for 
high-risk chemical facilities when submitting information to DHS to 
check for terrorist ties under 6 CFR 27.230(a)(12)(iv). The schedule 
will be published in the Federal Register. The schedule, when 
published, will require: (1) An initial submission of information 
either within a certain number of days after DHS issues a letter of 
authorization or within certain number of days after publication of the 
schedule, whichever is later; (2) additional submissions for 
individuals that become newly affected (e.g., new hires or other 
individuals given access to a restricted area or critical asset); (3) 
updates or corrections to information for affected individuals whose 
information has previously been submitted; and (4) notification when an 
affected individual no longer has access to a restricted area or 
critical asset. The schedule will likely vary by final tier. A proposed 
schedule is provided in subpart (B) of the ``Response To Comments 
Received During The 60-Day Comment Period'' section of this 30-Day 
notice. High-risk chemical facilities may request extensions or 
variances from this schedule based on unique or unusual circumstances.

Request for Exception to the Requirement Under 5 CFR 1320.8(b)(3)

    DHS is requesting from OMB an exception for the CFATS Personnel 
Surety Program to the Paperwork Reduction Act (PRA) requirement, as 
contained in 5 CFR 1320.8(b)(3), which requires Federal agencies to 
confirm that their information collections provide certain reasonable 
notices, under the Paperwork Reduction Act, to affected individuals. If 
this exception is granted, DHS will be relieved of the potential 
obligation to require high-risk chemical facilities to collect 
signatures or other positive affirmations of these notices from 
affected individuals. Whether or not this exception is granted, DHS 
will still require high-risk facilities to affirm that required Privacy 
Act notice has been provided to affected individuals before personal 
information is collected. See 5 U.S.C. 552a(e)(3).
    DHS's request for an exception to the requirement under 5 CFR 
1320.8(b)(3) would not exempt high-risk chemical facilities from having 
to adhere to applicable Federal, State, local, or tribal laws, or to 
regulations or policies pertaining to the privacy of facility personnel 
and the privacy of unescorted visitors.

Responses to Comments Received During the 60-Day Comment Period

    DHS received 17 comments in response to the 60-day notice for 
comment. Comments were received from three private citizens, four 
private sector companies, seven associations, one training council, and 
one professional society. One additional comment was a jointly 
submitted comment. Many of the comments were in response to the 
questions posed by DHS in the 60-day notice for comments. In this 
section of this notice, DHS first addresses specific questions that the 
Department solicited, then other comments related to the Personnel 
Surety Program, and finally unsolicited comments received in response 
to the 60-day notice.
    (A) On behalf of OMB, DHS solicited comments that evaluate whether 
the proposed collection of information is necessary for the proper 
performance of the functions of the agency, including whether the 
information will have practical utility.
    Comment: Commenters challenged the practical utility of requiring 
high-risk chemical facilities to update previously submitted 
information.
    Response: The information collected by DHS is generally static. 
However, DHS will require each high-risk chemical facility to update 
and correct information previously submitted about affected 
individuals. Updates and corrections do not necessarily need to be made 
immediately when submitted information changes; rather, DHS will 
require high-risk facilities to make updates and corrections in 
accordance with a DHS-approved schedule.
    For example, when a high-risk chemical facility becomes aware that 
an affected individual's information has changed (e.g., when a high-
risk chemical facility becomes aware that an affected individual has 
changed his/her name), the high-risk chemical facility must update the 
submitted information. DHS will also require a high-risk chemical 
facility to correct previously submitted information when the high-risk 
chemical facility becomes aware that an affected individual's 
information is incorrect (e.g., an affected individual's place or date 
of birth). Requiring high-risk chemical facilities to update and 
correct information about affected individuals will increase the 
accuracy of the data collected, and decrease the probability of 
incorrect matches to the information of known or suspected terrorists 
listed on the TSDB.
    One piece of information that may change is the list of high-risk 
chemical facilities within one company or organization to which an 
affected individual has access. When such a change occurs, updates are 
not required immediately but rather in accordance with a schedule to be 
published by DHS.
    Comment: Commenters challenged the practical utility of requiring 
high-risk chemical facilities to notify the Department when an affected 
individual no longer has access to a high-risk chemical facility's 
restricted area(s) or critical asset(s). Commenters suggested that this 
notification by a high-risk chemical facility to DHS would provide no 
value in the context of terrorism screening.
    Response: DHS will not rely on a single, one-time check to 
determine that an affected individual has ties to terrorism. Instead, 
DHS will continue to vet an affected individual's information against 
new and/or updated TSDB records as they become available, for as long 
as the affected individual has access to a high-risk chemical 
facility's restricted area(s) or critical asset(s). This process is 
referred to as ``recurrent vetting'' and is a standard DHS vetting 
practice. DHS will require high-risk chemical facilities to notify the 
Department when an affected individual no longer has access to a high-
risk chemical facility's restricted areas or critical assets so that 
the Department can cease recurrent vetting of the affected individual.
    Comment: Many commenters suggested that the proposed collection of 
information is needless and duplicative. Specifically, commenters 
suggested that the proposed information collection will place an undue 
burden on industry--in regard to time, money and other resources--by 
creating a program which duplicates an existing DHS screening or 
vetting program, such as the Transportation Worker

[[Page 18853]]

Identification Credential (TWIC) program.
    Response: TWIC's authorizing statute, the Maritime Transportation 
Security Act of 2002 (MTSA), as amended, 46 U.S.C. 70101 et seq., 
explicitly applies ``transportation security card'' requirements only 
to: ``individual[s] allowed unescorted access to secure area[s] 
designated in * * * [maritime] vessel or [maritime] facility security 
plan[s]'' (Sec.  70105(b)(2)(A)); certain MTSA license and permit 
holders (Sec.  70105(b)(2)(B)); maritime vessel pilots (Sec.  
70105(b)(2)(C)); maritime towing vessel personnel (Sec.  
70105(b)(2)(D)); individuals with access to certain protected maritime 
security information (Sec.  70105(b)(2)(E)); and ``other individuals 
engaged in port security activities'' (Sec.  70105(b)(2)(F)). 
Furthermore, individuals are only eligible to receive TWICs if they 
have not committed certain ``disqualifying criminal offense[s],'' or if 
they do not meet certain ``immigration status requirements'' 49 CFR 
1572.5(a)(1)-(2). However, the CFATS authorizing statute applies to 
``chemical facilities that * * * present high levels of security risk'' 
Department of Homeland Security Appropriations Act of 2007, Public Law 
109-295, section 550 (Oct. 4, 2006), as amended. CFATS Personnel Surety 
Program requirements apply only to high-risk chemical facilities' 
``personnel, and as appropriate * * * unescorted visitors with access 
to restricted areas or critical assets'' 6 CFR 27.230(a)(12). Moreover, 
facilities regulated under MTSA are exempt from CFATS. Accordingly, the 
CFATS Personnel Surety Program is not duplicative of the TWIC program.
    DHS recognizes that some affected individuals under CFATS possess 
TWICs or other credentials that rely on DHS-conducted TSDB vetting 
(e.g., an individual vetted under the TWIC program). DHS intends to 
reduce the burden of this collection by recognizing previous TSDB 
vetting results conducted by DHS. Therefore, an affected individual who 
possesses a current and valid TWIC will likely require less information 
to be submitted than an affected individual who does not have a TWIC. 
Some additional personal information will be required in order to 
verify that the affected individual has a previous TSDB vetting result 
upon which the TWIC was issued.
    Comment: One comment suggested that the vetting of affected 
individuals against the TSDB has little practical utility in 
identifying terrorists due to the large number of individuals whose 
names appear on the TSDB, even though they are not actually threats to 
national security.
    Response: As indicated in the CFATS interim final rule, the 
Department has determined that a TSDB check is necessary for the 
purpose of protecting restricted areas and critical assets of high-risk 
chemical facilities from persons who may have ties to terrorism. See 72 
FR 17708. The TSDB is the Federal Government's integrated and 
consolidated terrorist watchlist and is the appropriate database to 
identify individuals with terrorist ties.
    (B) On behalf of OMB, DHS solicited comments which evaluate the 
accuracy of the Department's estimate of the burden of the proposed 
collection of information, including the validity of the methodology 
and assumptions used.
    Comment: Commenters suggested that DHS did not provide sufficient 
detail about the proposed information collection to adequately evaluate 
the estimated burden.
    Response: In order to provide the public with more information to 
evaluate the estimated burden, the Department has established the 
information submission schedule outlined below. The Department will 
review comments received in response to this 30-day notice when 
finalizing the DHS schedule for submitting information. High-risk 
chemical facilities will be notified of the final DHS schedule prior to 
its implementation. The final DHS schedule will also be published in 
the Federal Register.

----------------------------------------------------------------------------------------------------------------
                                     Final tier 1        Final tier 2        Final tier 3        Final tier 4
----------------------------------------------------------------------------------------------------------------
Initial Submission of Affected    60 days after DHS   60 days after DHS   90 days after DHS   90 days after DHS
 Individual's Information.         issues a letter     issues a letter     issues a letter     issues a letter
                                   of authorization.   of authorization.   of authorization.   of authorization.
Submission of a New Affected      Within 30 days of   Within 30 days of   Within 60 days of   Within 60 days of
 Individual's Information.         being granted       being granted       being granted       being granted
                                   access.             access.             access.             access.
Submission of Updates and         Within 90 days of   Within 90 days of   Within 90 days of   Within 90 days of
 Corrections to an Affected        becoming aware of   becoming aware of   becoming aware of   becoming aware of
 Individual's Information.         the need for an     the need for an     the need for an     the need for an
                                   update or           update or           update or           update or
                                   correction.         correction.         correction.         correction.
Submission of notification that   Within 90 days of   Within 90 days of   Within 90 days of   Within 90 days of
 an affected individual no         access being        access being        access being        access being
 longer has access.                removed.            removed.            removed.            removed.
----------------------------------------------------------------------------------------------------------------

    Comment: Commenters generally believed the mechanics of the 
information submission and update process could place a heavy burden on 
high-risk facilities. One commenter indicated that DHS could expect 
submissions to be in the tens of thousands per month. Commenters 
suggested that the proposed 35-minute burden for the information 
collection was based on an incomplete estimate, and did not account for 
the duplicative submission of affected individuals' information by 
multiple high-risk chemical facilities in the cases of individuals who 
have access to restricted areas or critical assets at multiple 
facilities.
    Response: The estimated burden relied on the regulatory evaluation 
published for CFATS on April 1, 2007. In the regulatory evaluation, the 
Department estimated that 1,063,200 affected individuals would be 
vetted against the TSDB (i.e., 29,533 per month) over a three-year 
period. This estimate allows for the possibility that a specific 
individual could have access at multiple high-risk chemical facilities. 
The Department's population estimate also aligns with the commenters' 
expectations that DHS should expect tens of thousands of submissions 
during each month.
    The estimated time for a responsible entity to submit the 
information of each affected individual through the CSAT portal is 0.59 
hours per individual. This estimate is based upon the CFATS regulatory 
evaluation. The estimated time per affected individual was derived by 
assuming that (1) 30 minutes is

[[Page 18854]]

required to type in the required information for every affected 
individual once; (2) 5 percent of affected individuals will have some 
element of their information change annually, requiring 10 additional 
minutes of effort; and (3) 20 percent of affected individuals will lose 
access to restricted areas or critical assets annually, which will 
require 10 additional minutes of effort to remove each affected 
individual's information from CSAT.
    DHS believes that the information contained in this notice, in the 
Personnel Surety Program's 60-day PRA notice preceding this notice (74 
FR 27555 (June 10, 2009)), and in the CFATS regulatory evaluation 
provides sufficient detail about the proposed Personnel Surety 
Program's information collection process.
    Comment: One commenter suggested that the Department's estimate of 
the burden may not have accounted for the burden an affected individual 
incurs from investigations and adverse employment decisions that may 
result from the individual's possibly unjustified presence on the TSDB.
    Response: The burden outlined in this 30-day notice is limited in 
scope to those activities listed in 5 CFR 1320.3(b)(1). Specifically, 5 
CFR 1320.3(b)(1) requires the Department to estimate the total time, 
effort, or financial resources expended by persons to generate, 
maintain, retain, or disclose or provide information to or for a 
Federal agency.
    The Department is also seeking to collect five core data elements 
about each individual to be vetted under the Personnel Surety Program: 
Full name, date of birth, place of birth, gender, and citizenship. When 
taken together, these identifiers will minimize false positive matches 
to the TSDB. Furthermore, each potential match will be manually 
reviewed by Department adjudicators who have expertise in evaluating 
matches prior to confirmation that an individual's information matches 
the information of a known or suspected terrorist.
    (C) On behalf of OMB, DHS solicited comments to enhance the 
quality, utility, and clarity of the information to be collected.
    Comment: Most of the commenters requested additional clarity about 
what information DHS will routinely collect and update. Several 
commenters suggested that the information collected should be limited 
to information which is necessary to conduct an inquiry against the 
TSDB. One commenter also suggested that the information should be 
limited to personal information that is unlikely to change.
    Response: As outlined earlier in this 30-day notice, DHS will 
routinely collect an affected individual's full name, date of birth, 
place of birth, gender, and citizenship. DHS will also collect 
information that identifies the high-risk chemical facility or 
facilities to which the affected individual has access. DHS has limited 
the information routinely collected to include only that which is (1) 
Necessary to conduct a TSDB check and adjudicate potential matches, (2) 
unlikely to change, and (3) is essential for quickly understanding the 
risk a known or suspected terrorist poses to high-risk chemical 
facilities.
    DHS will not require immediate reporting of updates to previously 
submitted information. As previously discussed in this notice, DHS will 
permit high-risk chemical facilities to update information on a 
periodic basis in compliance with a DHS-approved schedule.
    Comment: Most commenters commended DHS for intending to recognize 
the previous TSDB vetting results completed by other DHS programs, such 
as the TWIC program. Several commenters, however, suggested that DHS 
should not collect information from high-risk chemical facilities for 
the purpose of verifying the validity of credentials issued as part of 
other DHS programs (which conduct TSDB vetting) because the burden of 
data collection necessary to verify such credentials could be 
burdensome.
    Response: In lieu of conducting new TSDB vetting on all affected 
individuals, DHS intends to recognize the results of previous TSDB 
vetting conducted on individuals enrolled in certain other DHS 
programs. Specifically, DHS is considering recognizing the previous 
TSDB vetting results completed by other DHS programs, such as TWIC, and 
the Trusted Traveler Programs (Secure Electronic Network for Travelers 
Rapid Inspection (SENTRI), Free and Secure Trade (FAST), and NEXUS). 
Further, DHS is also considering recognizing the results of TSDB 
vetting (conducted by DHS) upon which each State relies when issuing a 
Commercial Driver's License with a Hazardous Materials Endorsement 
(HME).
    This will likely require fewer pieces of information than are 
required to vet an individual who is not enrolled in another vetting 
program. DHS believes the burden of collecting those fewer pieces of 
information is accounted for in the estimated burden.
    This approach will also limit the number of instances in which 
different DHS programs may vet the same affected individual against the 
TSDB. If other programs' vetting results cannot be verified without 
substantial effort, DHS may initiate new vetting of an affected 
individual's information against the TSDB.
    Comment: Several commenters recommended that the Department 
recognize and offer reciprocity to the background checks, which include 
vetting against the TSDB, as conducted by the Department of Justice 
Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF). Commenters 
suggested that without this accommodation, the regulatory overlap 
between the two agencies will impose unreasonable burdens.
    Response: ATF does not conduct recurrent vetting against the TSDB, 
and thus is not appropriate as a reciprocal program to meet the 
requirements of CFATS.
    (D) On behalf of OMB, DHS solicited comments regarding the 
minimization of the burden of information collection on those who are 
to respond, including through the use of appropriate automated, 
electronic, mechanical, or other technological collection techniques or 
other forms of information technology (e.g., permitting electronic 
submissions of responses).
    Comment: Commenters encouraged DHS to consider the procedural and 
logistical challenges of large-scale data collection and transmission 
when developing the Personnel Surety portal component of CSAT. 
Specifically, commenters suggested that DHS permit each high-risk 
chemical facility to transmit data collectively (e.g., via a 
spreadsheet or other readily available electronic means). In other 
words, a high-risk chemical facility would collect the required 
information in a single file (or series of files) and upload it to DHS. 
Anything to the contrary--such as manual entry of discrete information 
into data fields--would result in an undue burden to the regulated 
community, increase human error, and raise information security 
concerns.
    Response: DHS will enable high-risk chemical facilities to upload 
information electronically about multiple affected individuals 
collectively. DHS would welcome suggestions about what technical 
standards, formats, or export/import capabilities are in use by high-
risk chemical facilities to facilitate such data submission.
    Comment: Many commenters suggested that third parties be authorized 
to support data submission to the Department. Specifically, many 
commenters suggested that DHS should permit third party vendors to 
enter information into CSAT on a facility's

[[Page 18855]]

behalf. One commenter suggested that (1) Background check providers 
understand the information security and privacy protections that apply 
to information; (2) a web of Federal, State, and local laws protect 
information (many corporations outsource personnel surety needs for 
this reason); and (3) experienced background check providers will help 
high-risk chemical facilities ensure that compliance with CFATS does 
not cause noncompliance with other laws which govern the collection, 
use, storage, or destruction of information.
    Response: To support the submission of information by high-risk 
chemical facilities, DHS has historically allowed--and will continue to 
allow--authorized third-party access to CSAT as a Preparer. Information 
about the CSAT Preparer user role can be found at https://www.dhs.gov/chemicalsecurity.
    Comment: A few commenters suggested that high-risk chemical 
facilities receive an electronic acknowledgement that the submitted 
information has been received. Such an acknowledgement would aid in 
demonstrating a high-risk chemical facility's compliance with 6 CFR 
27.230(a)(12)(iv).
    Response: DHS will send an electronic verification of submission to 
high-risk chemical facilities when a high-risk chemical facility (1) 
Submits information about an affected individual for the first time, 
(2) submits updated or corrected information about an affected 
individual, and/or (3) notifies DHS that an affected individual no 
longer has access to restricted areas or critical assets.
    (E) DHS solicited comments that respond to the Department's 
interpretation of the population affected by RBPS-12's background check 
requirement.
    Comment: Many commenters provided extensive responses to the 
Department's interpretation of the population which is affected by 
RBPS-12. The comments suggested that the Department's interpretation 
expanded the definition beyond the scope of CFATS. The comments 
referenced the preamble to the CFATS Interim Final Rule, in which DHS 
stated that each facility ``shall identify critical assets and 
restricted areas and establish which employees and contractors may need 
unescorted access to those areas or assets, and thus must undergo a 
background check'' 72 FR 17708 (Apr. 7, 2007). Commenters also 
suggested that vetting escorted facility personnel is inconsistent with 
other regulatory schemes (e.g., TWIC).
    Response: The regulatory text makes no distinction between facility 
personnel who are escorted and facility personnel who are unescorted. 
The actual text of CFATS, at 6 CFR 27.230(a)(12), uses the term 
``unescorted'' to modify only the noun ``visitors.'' As such, if 
facility personnel have access, either unescorted or otherwise (e.g., 
escorted), to restricted areas or critical assets, then they are 
affected individuals who must be screened for the purposes of the 
Personnel Surety Program.
    However, the preamble to the CFATS Interim Final Rule could be read 
to imply that a different population would undergo vetting rather than 
the population suggested in the regulatory text of CFATS. To the extent 
that there is a potential conflict, the regulatory text of CFATS takes 
precedence. As such, the populations of individuals who must be vetted 
under 6 CFR 27.230(a)(12) are the same as those described in the 60-day 
notice preceding this 30-day notice: (1) Facility personnel (e.g., 
employees and contractors) with access (unescorted or otherwise) to 
restricted areas or critical assets, and (2) unescorted visitors with 
access to restricted areas or critical assets.
    DHS would like to underscore that a high-risk chemical facility has 
wide latitude in its unique and tailored SSP regarding the terms under 
which facility personnel will be granted access, either unescorted or 
otherwise, to restricted areas and critical assets. Each high-risk 
chemical facility will need to consider its unique security concerns 
when determining which individuals will be afforded access to 
restricted areas or critical assets.
    Additionally, DHS will expect that each facility be able to explain 
why an individual is an affected individual. Specifically, an affected 
individual must meet one and only one of the following three criteria: 
(1) The individual is facility personnel with unescorted access to 
restricted areas or critical assets; (2) the individual is facility 
personnel with access, but not unescorted access, to restricted areas 
or critical assets; or (3) the individual is an unescorted visitor with 
access to restricted areas or critical assets.
    (F) DHS solicited comments which respond to the statement that a 
Federal law enforcement agency may, if appropriate, contact the high-
risk chemical facility as a part of a law enforcement investigation 
into terrorist ties of facility personnel.
    Comment: One commenter expressed concern that contact from a 
Federal law enforcement agency about an individual who is properly on 
the watchlist but is innocent nevertheless may result in adverse 
employment decisions.
    Response: Contact by a Federal law enforcement organization does 
not necessarily indicate that any affected person is a known or 
suspected terrorist. Further, employment decisions made by a high-risk 
chemical facility in response to contact by a Federal law enforcement 
agency are not regulated by CFATS. A corporation or facility should 
ensure that it is complying with all applicable laws, including 
applicable state regulations, when considering employment decisions.
    It should also be noted that DHS will randomly audit its vetting 
processes in an effort to maximize vetting accuracy and Personnel 
Surety Program efficiency. As part of this auditing, DHS may request 
information on a small percentage of affected individuals after those 
individuals have been initially vetted against the TSDB. A request for 
additional information does not imply, and should not be construed to 
indicate, that an individual is known or suspected to be associated 
with terrorism.
    (G) DHS solicited comments which respond to the Department's 
intention to seek an exception to the notice requirement under 5 CFR 
1320.8(b)(3).
    Comment: DHS received several comments in response to the 
Department's intention to seek an exception to the PRA's notice 
requirement. Every comment expressed concern about the impact to an 
affected individual's right to be granted notice under the Privacy Act. 
See 5 U.S.C. 552a(e)(3).
    Response: The request for an exception to 5 CFR 1320.8(b)(3) is 
related to the PRA and unrelated to the Privacy Act; 5 CFR 1320.8(b)(3) 
requires that each collection of information shall inform and provide 
reasonable notice to the potential persons to whom the collection of 
information is addressed. The request by DHS for an exception to 5 CFR 
1320.8(b)(3) from OMB will ensure that DHS will be relieved of the 
potential obligation to require high-risk chemical facilities to 
collect signatures or other positive affirmations of these notices from 
affected individuals (although high-risk chemical facilities would not 
be precluded from collecting signatures or other positive affirmations 
of notice if this exception is granted). This exception will then 
afford high-risk chemical facilities wide latitude in choosing how to 
collect, recollect, or leverage already collected data based upon their 
unique business operations and processes.

[[Page 18856]]

    Because the information being collected under this information 
collection request is information that will be used to identify 
individuals with known or suspected terrorist ties, the Department 
believes that it is important for affected individuals to be informed 
of the Government's intended use of their information. However, under 
CFATS the Department regulates high-risk chemical facilities and not 
affected individuals. Although the affected individual is ultimately 
the source of the collected information, the burden of submitting the 
collected data to DHS lies on the high-risk chemical facility. (For 
example, high-risk chemical facilities may collect affected 
individuals' information by having affected individuals fill out forms, 
or high-risk chemical facilities may submit batch files extracted from 
databases which contain the necessary information previously collected 
from affected individuals.) An exception to 5 CFR 1320.8(b)(3) will 
ensure that the Department does not need to inspect, audit, or receive 
confirmation (e.g., signatures of acknowledgement from affected 
individuals) from high-risk chemical facilities where every affected 
individual has received notice under the PRA of this information 
collection.
    The Department's request for an exception to 5 CFR 1320.8(b)(3) of 
the PRA is not a request for an exception to provide notice to affected 
individuals under the Privacy Act. If this exception is granted, high-
risk chemical facilities will be relieved of the potential obligation 
to collect signatures or other positive affirmations from affected 
individuals, but will still be obligated to affirm that required 
privacy notice has been provided to affected individuals before 
personal information is collected.
    Comment: Several commenters suggested that affected individuals 
should be notified in writing that they must undergo background checks 
consistent with the requirements of 6 CFR 27.230 as a condition of 
employment at any high-risk chemical facility. Commenters also 
suggested that affected individuals should be advised of their rights 
to contest the findings of background checks, and of how to contest 
those findings.
    Response: No affirmative written statements of this sort are 
required by CFATS. However, DHS has discussed Personnel Surety Program 
background check requirements in CFATS in the Advanced Notice of 
Rulemaking preceding CFATS (71 FR 78276 (Dec. 28, 2006)), the CFATS 
Risk-Based Performance Standards Guidance Document (May 2009), and the 
Personnel Surety Program's 60-day PRA notice (74 FR 27555 (June 10, 
2009)).
    (H) DHS also received unsolicited comments in response to the 60-
day notice related to the CFATS Personnel Surety Program.
    Comment: One commenter expressed disappointment in the proposed 
information collection, because the commenter believed that the 
collection approach did not guarantee the availability of all due 
process protections under notice and comment rulemaking pursuant to the 
Administrative Procedure Act (APA).
    Response: Through this notice and through DHS's June 10, 2009, 60-
day PRA notice, 74 FR 27555 (June 10, 2009), DHS is fulfilling its 
obligations to solicit and respond to public comment under the PRA. 
DHS's PRA publications detail (1) which data points the Department will 
collect in order to conduct vetting against the TSDB; (2) how the 
Department will collect those data points; and (3) how the Department 
will perform vetting against the TSDB. This type of program description 
is the type of detail which is appropriate in a PRA notice, because it 
allows DHS to solicit comments on how to improve the proposed 
information collection and to consider ways to reduce the burden the 
CFATS Personnel Surety Program will place on affected individuals and 
high-risk chemical facilities.
    Comment: Many commenters expressed concern that DHS would not 
notify high-risk chemical facilities when affected individuals are 
determined to be known or suspected terrorists. Commenters stated that 
as a result of such lack of notification, high-risk chemical facilities 
may unknowingly grant access to individuals who are known or suspected 
to have terrorist ties, thereby subjecting facility personnel and 
surrounding communities to unnecessary risk. Some of the commenters 
acknowledged that there may be circumstances when it is either 
appropriate or inappropriate to contact a facility in the context of a 
law enforcement investigation, but stated that DHS should not withhold 
TSDB vetting results as a general matter. Other commenters suggested 
that DHS should always notify facilities about known or suspected 
terrorists to enable appropriate facility action, such as potentially 
limiting or denying known or suspected terrorists' access to restricted 
areas or critical assets.
    Response: DHS will not routinely notify high-risk chemical 
facilities of Personnel Surety Program vetting results. DHS will 
coordinate with Federal law enforcement entities to monitor and/or 
prevent situations in which known or suspected terrorists have access 
to high-risk chemical facilities. The precise manner in which DHS or 
Federal law enforcement entities could contact high-risk chemical 
facilities following vetting are beyond the scope of this PRA notice.
    Comment: Commenters also suggested that failure to notify an 
individual that he/she is a known or suspected terrorist would abrogate 
that individual's right to request an administrative adjudication of a 
finding under RBPS-12 that he/she is a potential security threat.
    Response: Administrative adjudications which contest findings that 
affected individuals are potential security threats are provided by 6 
CFR 27.310(a)(1). The Department does not intend to limit affected 
individuals' abilities to request administrative adjudications merely 
because it will not routinely notify them of TSDB vetting results. 
Individuals who believe they have been adversely affected by vetting 
may file Notices of Application for Review with the Department.
    Comment: One commenter recommended that DHS should not collect an 
acknowledgement of State and local privacy law compliance from high-
risk chemical facilities. The commenter suggested that requiring a 
compliance certification would add unnecessary procedural burden to the 
Personnel Surety Program because DHS is not responsible for State or 
local privacy law compliance.
    Response: DHS agrees with the commenter and will not collect this 
acknowledgement as part of Personnel Surety Program information 
submissions.

Solicitation of Comments

    The Office of Management and Budget is particularly interested in 
comments which:
    1. Evaluate whether the proposed collection of information is 
necessary for the proper performance of the functions of the agency, 
including whether the information will have practical utility;
    2. Evaluate the accuracy of the agency's estimate of the burden of 
the proposed collection of information, including the validity of the 
methodology and assumptions used;
    3. Enhance the quality, utility, and clarity of the information to 
be collected; and
    4. Minimize the burden of the collection of information on those 
who are to respond, including through the use of appropriate automated, 
electronic, mechanical, or other technological collection techniques or 
other forms of information technology

[[Page 18857]]

(e.g., permitting electronic submissions of responses).
    The Department is particularly interested in comments which:
    1. Respond to the Department's interpretation of the population 
affected by RBPS-12 background checks, as outlined in 6 CFR 
27.230(a)(12);
    2. Respond to fact that the Department or a Federal law enforcement 
agency may, if appropriate, contact the high-risk chemical facility as 
a part of a law enforcement investigation into terrorist ties of 
facility personnel;
    3. Respond to the Department's intention to collect information 
that identifies the high-risk chemical facilities, restricted areas and 
critical assets to which each affected individual has access; and
    4. Respond to the Department on its intention to seek an exception 
to the notice requirement under 5 CFR 1320.8(b)(3).

Analysis

    Agency: Department of Homeland Security, National Protection and 
Programs Directorate, Office of Infrastructure Protection, 
Infrastructure Security Compliance Division.
    Title: CFATS Personnel Surety Program.
    Form: Not Applicable.
    OMB Number: 1670-NEW.
    Frequency: As required by the DHS-approved schedule.
    Affected Public: High-risk chemical facilities as defined in 6 CFR 
part 27, high-risk chemical facility personnel, and as appropriate, 
unescorted visitors with access to restricted areas or critical assets.
    Number of Respondents: 354,400 individuals.
    Estimated Time per Respondent: 0.59 hours (35.4 minutes).
    Total Burden Hours: 210,351.7 annual burden hours.
    Total Burden Cost (capital/startup): $0.00.
    Total Burden Cost (operating/maintaining): $17,669,543.

    Dated: March 6, 2010.
Thomas Chase Garwood, III,
Chief Information Officer, National Protection and Programs 
Directorate, Department of Homeland Security.
[FR Doc. 2010-8312 Filed 4-12-10; 8:45 am]
BILLING CODE 9110-9P-P