How It All Began: The History and Making of the CFATS Program

April 9, 2022, marked the fifteenth anniversary of the publication of the Chemical Facility Anti-Terrorism Standards (CFATS) interim final rule (IFR). This IFR initiated the CFATS program, a program that has been regulating chemical security in the United States for the last decade and a half. Over the next six months, we'll look back on the past 15 years of securing the nation's highest-risk chemical facilities and highlight what's on the horizon for chemical security. We'll also share stories on how we're working to continually adapt to our nation's evolving threat environment and ensure the security of our nation's chemical facilities.

This month, we're starting where it all began, with the publication of the CFATS IFR. Creating a new regulation is never easy -- it takes foresight and commitment from the nation's best security experts and policy writers. In our first publication, we reflect on the complex threat environment that gave rise to the need for greater security at our nation's highest-risk chemical facilities and the leadership that envisioned and created the CFATS program.

The devastating attacks of September 11, 2001, prompted a national reassessment of how to protect our country from terrorists. Less than two weeks after the attacks, Pennsylvania Governor Tom Ridge was appointed as the first Director of the Office of Homeland Security in the White House. The office oversaw and coordinated the national strategy to safeguard the country against terrorism and respond to any future attacks. With the passage of the Homeland Security Act by Congress in November 2002, the Department of Homeland Security formally came into being as a standalone, Cabinet-level department, officially opening its doors on March 1, 2003.

The creation of the Department of Homeland Security signaled a broad recognition that the changing nature of the threats facing America required a unified approach to homeland security. As a new organization, the Department was responsible for the protection of our nation against threats, including enemies that had the potential to strike using a wide variety of weapons. The Department was also charged with looking to the future to prepare the nation to confront an unknown and evolving threat environment.

The weaponization of chemicals became an early priority for the newly established Department. Shortly after 9/11, the Washington Post reported on a classified study conducted by the U.S. Army Surgeon General that a terrorist attack resulting in a chemical release in a densely populated area could injure or kill as many as 2.4 million people. In the months that followed, several news outlets gained access to reports discussing the risk of an attack on facilities with dangerous chemicals.

In the years preceding the establishment of the CFATS program, some companies in the chemical industry voluntarily implemented security programs, in some cases making significant capital investments in security measures. However, many of the facilities holding dangerous chemicals are not part of the traditional Chemical Sector at all -- high-risk chemicals are used in industries, including semiconductor manufacturing, cosmetics, wineries and breweries, and pools and waterparks, which possessed sufficient amounts of chemical to result in terrorist attacks. Significant security gaps remained across the wide universe of facilities holding dangerous chemicals. It was clear that voluntary efforts alone would not provide sufficient security from the threat of chemical terrorism.

A 2006 Government Accountability Office (GAO) report stated that the nation's chemical facilities presented an attractive target for terrorists who were intent on causing massive damage. Of particular concern were facilities housing toxic chemicals that could become airborne if released or stolen and used to create a weapon. A Congressional Service report provided additional evidence that U.S. chemical facilities may be targeted by terrorists to gain access to chemicals. The threat was real: both the government and the chemical industry stakeholders knew it was time to act.

On September 8, 2006, DHS Secretary Michael Chertoff requested that Congress provide the Department with the regulatory authority to establish and require implementation of risk-based performance standards for the security of the nation's high-risk chemical facilities. Congress took action and on October 4, 2006, passed the DHS Appropriations Act of 2007, which included provisions to create such a program:

Sec. 550  "No later than six months after the date of enactment of this Act, the Secretary of Homeland Security shall issue interim final regulations establishing risk-based performance standards for security of chemical facilities and requiring vulnerability assessments and the development and implementation of site security plans for chemical facilities: Provided, That such regulations shall apply to chemical facilities that, in the discretion of the Secretary, present high levels of security risk..."

From its inception, DHS worked with industry partners, members of civil society, federal agencies, and state and local entities to safeguard the country from the threat of dangerous chemicals being weaponized. It was clear that there were gaps in chemical security that needed to be addressed through a coordinated, national effort.

With this authority, the Department could now fill a significant security gap in the country's anti-terrorism efforts. By directing the Secretary to issue "interim final regulations," Congress gave DHS the ability to proceed without the traditional notice-and-comment period usually seen in rulemaking.

Knowing the value of industry partners' feedback, the Department believed it would be prudent to seek comment on the issues that would be addressed by the regulations -- while still maintaining the aggressive six-month timeline for implementation. They sought public comment from all interested parties by February 7, 2007.

After gathering and incorporating comments from individuals, trade associations, companies, and numerous others, DHS published an Interim Final Rule for the Chemical Facility Anti-Terrorism Standards (CFATS) regulation on April 9, 2007.

Over the next six months, a small team of experts -- including lawyers, policy makers, scientists, and security professionals -- came together to write the policies that would guide the CFATS program for years to come. "The program's success is in large part due to our stakeholders, the individuals and companies that actually possess, use, and secure chemicals. The stakeholders were a part of the solution, and that was and continues to be the key to CFATS program's success," said Matt Bettridge, senior policy analyst for CISA Chemical Security, who was an integral member of the team that drafted the CFATS regulation.

On November 20, 2007, the CFATS Final Rule and Appendix A, a list of more than 300 chemicals and the security issues related to them, were published. These regulations, as well as the Risk-Based Performance Standards (RBPS) guidance (.pdf, 1.86 MB), would lay the foundation for the first regulatory chemical security program, setting the global standard for the next decade and a half.

The publication of the CFATS Final Rule was just the beginning of our nation's collective effort to secure dangerous chemicals at our highest-risk chemical facilities. From now through the end of the year, CISA will be highlighting important milestones in the history of the CFATS program. We'll not only cover the impact these milestones had on the evolution of chemical security in the United States, but also the broader security landscape. We look forward to sharing more about the development of the CFATS program, covering topics such as:

• From Policy to Program: Implementing CFATS
• A Shared Responsibility and a Team Effort: Building and Sustaining Chemical Security with our Partners
• Broadening the Nation's Chemical Security Aperture: ChemLock
• CSAT 2.0: Engineering the Backbone of the CFATS Program
• Connected and Protected: Integrating critical cyber-physical systems for enhanced chemical security
• Looking Back, Looking Forward: The Future of CFATS
• An Inside Job: Stopping Terrorists from Gaining Insider Access to Dangerous Chemicals
• Leading the World: CFATS on the Global Stage