# Chemical Facility Anti-Terrorism Standards Personnel Surety Program > Briefs, arguments, decisions, and more. URL: https://www.frixlaw.com/law-library/documents/fr%3A2014-02082 ## Record - **Collection:** Federal Register - **Document type:** Notice - **Published:** February 3, 2014 - **Citation:** 79 FR 6418 ## Text DEPARTMENT OF HOMELAND SECURITY [Docket No. DHS-2012-0061] Chemical Facility Anti-Terrorism Standards Personnel Surety Program AGENCY: National Protection and Programs Directorate, DHS. ACTION: 30-Day notice and request for comments; New Information Collection Request: 1670-NEW. SUMMARY: The Department of Homeland Security (DHS), National Protection and Programs Directorate (NPPD), Office of Infrastructure Protection (IP), Infrastructure Security Compliance Division (ISCD) will submit the following Information Collection Request (ICR) to the Office of Management and Budget (OMB) for review and clearance in accordance with the Paperwork Reduction Act (PRA) of 1995 (Pub. L. 104-13, 44 U.S.C. Chapter 35). The Department previously published a notice about the CFATS Personnel Surety Program Information Collection Request in the Federal Register on March 22, 2013, for a 60-day public comment period. 1 On May 21, 2013, the Department extended the comment period an additional 14 days. 2 In this notice, NPPD is (1) responding to 28 comments submitted in response to the 60-day notice previously published about this ICR, and (2) soliciting public comments concerning this ICR for an additional 30 days. This notice also describes the nature of the CFATS Personnel Surety Program Information Collection Request, the categories of respondents, the estimated burden (in hours), and the estimated burden cost necessary to implement the Chemical Facility Anti-Terrorism Standards (CFATS) Personnel Surety Program pursuant to 6 CFR 27.230(a)(12)(iv). 1 See 78 FR 17680 (March 22, 2013). The 60-day Federal Register notice for Information Collection 1670-NEW, which solicited comments for 60 days, may be found at https://federalregister.gov/a/2013-06184 . 2 See 78 FR 29759 (May 21, 2013). The Federal Register notice that extended the comment period an additional 14 days may be viewed at https://federalregister.gov/a/2013-12059 . DATES: Comments are encouraged and will be accepted until March 5, 2014. This process is conducted in accordance with 5 CFR 1320.8. ADDRESSES: Interested persons are invited to submit written comments on the proposed information collection to the Office of Information and Regulatory Affairs, OMB. Comments should be addressed to OMB Desk Officer, Department of Homeland Security, National Protection and Programs Directorate. Comments must be identified by the docket number DHS-2012-0061 and may be submitted by one of the following methods: • Federal eRulemaking Portal: http://www.regulations.gov. • Email: oira_submission@omb.eop.gov . Include the docket number in the subject line of the message. • Fax: (202) 395-5806. Instructions: All submissions received must include the words “Department of Homeland Security” and the docket number for this action. Comments received will be posted without alteration at http://www.regulations.gov, including any personal information provided. Comments that include trade secrets, confidential commercial or financial information, Chemical-terrorism Vulnerability Information (CVI), 3 Sensitive Security Information (SSI), 4 or Protected Critical Infrastructure Information (PCII) 5 should not be submitted to the public regulatory docket. Please submit such comments separately from other comments in response to this notice. Comments containing trade secrets, confidential commercial or financial information, CVI, SSI, or PCII should be appropriately marked and submitted by mail to the Office of Information and Regulatory Affairs, OMB. Comments should be addressed to OMB Desk Officer, care of the DHS/NPPD/IP/ISCD CFATS Program Manager at the Department of Homeland Security, 245 Murray Lane SW., Mail Stop 0610, Arlington, VA 20528-0610. Comments must be identified by docket number DHS-2012-0061. 3 For more information about CVI see 6 CFR 27.400 and the CVI Procedural Manual at http://www.dhs.gov/xlibrary/assets/chemsec_cvi_proceduresmanual.pdf . 4 For more information about SSI see 49 CFR part 1520 and the SSI Program Web page at http://www.tsa.gov/ssi . 5 For more information about PCII see 6 CFR part 29 and the PCII Program Web page at http://www.dhs.gov/protected-critical-infrastructure-information-pcii-program . OMB is particularly interested in comments that: 1. Evaluate whether the proposed collection of information is necessary for the proper performance of the functions of the agency, including whether the information will have practical utility; 2. Evaluate the accuracy of the agency's estimate of the burden of the proposed collection of information, including the validity of the methodology and assumptions used; 3. Enhance the quality, utility, and clarity of the information to be collected; and 4. Minimize the burden of the collection of information on those who are to respond, including through the use of appropriate automated, electronic, mechanical, or other technological collection techniques or other forms of information technology, e.g., permitting electronic submissions of responses. Table of Contents I. Supplementary Information • Summary of Options Available to High-Risk Chemical Facilities To Comply With RBPS 12(iv) • Scope of This Notice and Commitment To Explore Additional Options in the Future • Who is Impacted by the CFATS Personnel Surety Program? • What/Who is the Source of the Information Under Option 1 and Option 2 • CSAT User Roles and Responsibilities • Burden Resulting From the Submission of Duplicate Records About an Affected Individual • Compliance With RBPS 12(iv) and the Potential for Increased Burden to Enter the Restricted Areas or Critical Assets at a High-Risk Chemical Facility • Additional Data Privacy Considerations II. Information Collected About Affected Individuals • Option 1: Collecting Information To Conduct Direct Vetting • Option 2: Collecting Information To Use Vetting Conducted Under Other DHS Programs • Option 3: Electronic Verification of TWIC • Other Information Collected III. Request For Exception To the Requirement Under 5 CFR 1320.8(b)(3) IV. Responses to Comments Submitted During 60-Day Comment Period V. The Department's Methodology in Estimating the Burden • Summary of Changes From 60-Day Notice • Frequency • Affected Public • Number of Respondents ○ Number and Type of High-Risk Chemical Facilities ○ Estimated Number of Affected Individuals at Each Type of High-Risk Chemical Facility—Unescorted Visitors With Access to Restricted Areas or Critical Assets ○ Estimated Number of Affected Individuals at Each Type of High-Risk Chemical Facility—Facility Personnel With Access To Restricted Areas or Critical Assets ○ Summary of Alternatives to Estimate the Number of Respondents ○ Limitation of Respondents To Tier 1 and Tier 2 Facilities • Total Annual Burden Hours • Estimated Time per Respondent • Total Burden Cost (Capital/Startup) ○ Estimating Capital Costs for Option 3—Number and Type of High-Risk Chemical Facilities That May Choose to Use Option 3 ○ Estimating Capital Costs for Option 3—TWIC Reader Costs ○ Consideration of Other Capital Costs • Recordkeeping Costs • Total Burden Cost (Operating/Maintaining) VI. Solicitation of Comments VII. Analysis I. Supplementary Information Section 550 of the Department of Homeland Security Appropriations Act of 2007, Public Law 109-295 (2006) (“Section 550”), provides the Department with the authority to identify and regulate the security of high-risk chemical facilities using a risk-based approach. On April 9, 2007, the Department issued the CFATS Interim Final Rule (IFR) implementing this statutory mandate. See 72 FR 17688 (April 9, 2007). Section 550 requires that the Department establish risk-based performance standards (RBPS) for high-risk chemical facilities and under CFATS the Department promulgated 18 RBPS. Each chemical facility that has been finally determined by the Department to be high-risk must submit a Site Security Plan (SSP), or an Alternative Security Program (ASP) if the facility so chooses, for Department approval that satisfies each applicable RBPS. RBPS 12—Personnel Surety—requires high-risk chemical facilities to: Perform appropriate background checks on and ensure appropriate credentials for facility personnel, and as appropriate, for unescorted visitors with access to restricted areas or critical assets, including, (i) Measures designed to verify and validate identity; (ii) Measures designed to check criminal history; (iii) Measures designed to verify and validate legal authorization to work; and (iv) Measures designed to identify people with terrorist ties[.] See 6 CFR 27.230(a)(12). As explained by the Department in the preamble to the CFATS IFR, the ability to identify affected individuals (i.e., facility personnel or unescorted visitors with access to restricted areas or critical assets at high-risk chemical facilities) who have terrorist ties is an inherently governmental function and necessarily requires the use of information held in government-maintained databases that are unavailable to high-risk chemical facilities. See 72 FR 17709 (April 9, 2007). Thus, under RBPS 12(iv), the Department and high-risk chemical facilities must work together to satisfy the “terrorist ties” aspect of the Personnel Surety performance standard. As a result, the CFATS Personnel Surety Program will identify individuals with terrorist ties that have or are seeking access to the restricted areas and/or critical assets at the nation's high-risk chemical facilities. Accordingly, in the preamble to the CFATS IFR, the Department outlined two potential approaches to help high-risk chemical facilities satisfy that particular standard, both of which would involve high-risk chemical facilities submitting certain information to the Department. See id. The first approach would involve facilities submitting certain information about affected individuals to the Department, which the Department would use to vet those individuals for terrorist ties. Specifically, identifying information about affected individuals would be compared against identifying information of known or suspected terrorists contained in the federal government's consolidated and integrated terrorist watchlist, the Terrorist Screening Database (TSDB), which is maintained on behalf of the federal government by the Department of Justice (DOJ) Federal Bureau of Investigation (FBI) in the Terrorist Screening Center (TSC). 6 6 For more information about the TSDB, see DOJ/FBI—019 Terrorist Screening Records System, 72 FR 47073 (August 22, 2007). In order to avoid unnecessary duplication of terrorist screening, the Department also described an additional approach under which high-risk chemical facilities would submit information about affected individuals possessing certain credentials that rely on security threat assessments conducted by the Department. See 72 FR 17709 (April 9, 2007). The Department has developed a CFATS Personnel Surety Program that will provide high-risk chemical facilities additional options to comply with RBPS 12(iv) while continuing to make available the two alternatives outlined in the preamble to the CFATS IFR. In addition to the alternatives expressly described in this document, the Department also intends to permit high-risk chemical facilities to propose other alternative measures for terrorist ties identification in their SSPs or ASPs, which the Department will consider on a case-by-case basis in evaluating high-risk chemical facilities' SSPs or ASPs. As a result of the CFATS Personnel Surety Program, regardless of the option selected by the high-risk chemical facility, the Department will identify individuals with terrorist ties that have or are seeking access to the restricted areas and/or critical assets at the nation's high-risk chemical facilities. The first option is consistent with the primary approach described in the CFATS IFR preamble, as discussed above. Under Option 1—Direct Vetting, high-risk chemical facilities (or others acting on their behalf) would submit certain information about affected individuals to the Department through a Personnel Surety application in an online technology system developed under CFATS called the Chemical Security Assessment Tool (CSAT). Access to and the use of CSAT is provided free of charge to high-risk chemical facilities (or others acting on their behalf). Under this option, information about affected individuals submitted by, or on behalf of, high-risk chemical facilities would be vetted against information contained in the federal government's consolidated and integrated terrorist watchlist. The second option is also consistent with the second approach described in the CFATS IFR preamble. Under Option 2—Use Of Vetting Conducted Under Other DHS Programs, high-risk chemical facilities (or others acting on their behalf) would also submit certain information about affected individuals to the Department through the CSAT Personnel Surety application. Option 2 would, however, allow high-risk chemical facilities and the Department to take advantage of the vetting for terrorist ties already being conducted on affected individuals enrolled in the Transportation Worker Identification Credential (TWIC) Program, Hazardous Materials Endorsement (HME) Program, as well as the NEXUS, Secure Electronic Network for Travelers Rapid Inspection (SENTRI), Free and Secure Trade (FAST), and Global Entry Trusted Traveler Programs. 7 All of these programs conduct terrorist ties vetting equivalent to the terrorist ties vetting that would be conducted under Option 1. 8 Under Option 2, high-risk chemical facilities, or their designees (e.g., third parties), could submit information to the Department about affected individuals possessing the appropriate credentials to enable the Department to electronically verify the affected individuals' enrollments in these other programs. The Department would subsequently notify the Submitter of the high-risk chemical facility whether or not an affected individual's enrollment in one of these other DHS programs was electronically verified. The Department would also periodically re-verify each affected individual's continued enrollment in one of these other programs, and notify the appropriate designee of the high-risk chemical facility of significant changes in the status of an affected individual's enrollment (e.g., if an affected individual who has been enrolled in the HME Program ceases to be enrolled, the Department would change the status of the affected individual in the CSAT Personnel Surety application and notify the Submitter). 9 Electronic verification and re-verification would enable the Department and the high-risk chemical facility to ensure that an affected individual's credential or endorsement is appropriate to rely on (i.e., an indicator that the affected individual is being recurrently vetted for terrorist ties) in compliance with RBPS 12(iv). 7 U.S. Customs and Border Protection (CBP) has introduced SENTRI and Global Entry as Trusted Traveler Programs since the publication of CFATS in April 2007. The Department, therefore, intends to enable high-risk chemical facilities (or their designees) to submit information about affected individuals' SENTRI and Global Entry enrollments to DHS under Option 2, even though SENTRI and Global Entry were not listed along with the other Trusted Traveler Programs in the CFATS IFR preamble. See 72 FR 17709 (April 9, 2007). 8 Each of the DHS programs referenced conducts recurrent vetting, which is equivalent to the terrorist ties vetting conducted under Option 1. Recurrent vetting compares an affected individual's information against new and/or updated TSDB records as those new and/or updated records become available. Recurrent vetting is a Department best practice. 9 When the Department notifies the appropriate designee of the high-risk chemical facility of significant changes in the status of an affected individual's enrollment, such a notification should not be construed to indicate that an individual has terrorist ties or be treated as derogatory information. In addition to Option 1 and Option 2, the Department has considered other potential options to help high-risk chemical facilities satisfy RBPS 12(iv). In particular, the Department has investigated the feasibility of options that would not involve the submission of information about an affected individual if the affected individual participated in one of the programs identified under Option 2. The Department believes that, for the purpose of compliance with RBPS 12(iv), simply relying on a visual inspection of a credential or endorsement is inadequate because the credential or endorsement could be expired, revoked, or fraudulent. However, the Department has concluded that information about an affected individual, enrolled in a DHS program that conducts vetting for terrorist ties equivalent to the vetting that would be conducted under Option 1, would not need to be submitted to the Department if the credential in the possession of the affected individual is electronically verified and validated. Accordingly, the Department plans to offer high-risk chemical facilities a third option. Under Option 3—Electronic Verification of TWIC, a high-risk chemical facility (or others acting on their behalf) would not submit information about affected individuals in possession of TWICs to the Department if the high-risk chemical facility (or others acting on their behalf) electronically verify and validate the affected individuals' TWICs 10 through the use of TWIC readers (or other technology that is periodically updated using the with revoked card information). 11 Any high-risk chemical facilities that choose this option would need to describe in their SSPs or ASPs the procedures they will follow if they choose to use TWIC readers for compliance with RBPS 12(iv). 12 10 Verification and validation of an affected individual's TWIC requires authentication that the affected individual's TWIC is (1) a valid credential issued by TSA, and (2) contains the Card Holder Unique Identifier and correct digital signature. 11 The Department currently offers two ways to determine if a TWIC has been revoked (or reported lost or stolen). One is the Canceled Card List (CCL), the other is the Certificate Revocation List (CRL). More information about the Canceled Card List may be found at http://www.tsa.gov/sites/default/files/publications/pdf/twic/canceled_card_list_ccl_faq.pdf . More information about the CRL may be in the TWIC NPRM published on March 29, 2009 at 74 FR 13364 which may be accessed at https://www.federalregister.gov/articles/2009/03/27/E9-6852/transportation-worker-identification-credential-twic-reader-requirements#p-122 . 12 On March 22, 2013, the U.S. Coast Guard published a notice of proposed rulemaking (NPRM) titled “TWIC Reader Requirements.” The procedures for using TWIC readers that are discussed in that NPRM would not apply to high-risk chemical facilities regulated under CFATS. Likewise, the ways in which high-risk chemical facilities could leverage TWICs as part of the CFATS Personnel Surety Program do not apply to maritime facilities or vessels regulated by the U.S. Coast Guard. High-risk chemical facilities would have discretion as to which option(s) to use for an affected individual. For example, even though a high-risk chemical facility could comply with RBPS 12(iv) for certain affected individuals by using Option 2, the high-risk chemical facility could choose to use Option 1 for those affected individuals. Similarly, a high-risk chemical facility, at its discretion, may choose to use either Option 1 or Option 2 rather than Option 3 for affected individuals who have TWICs. High-risk chemical facilities also may choose to combine Option 1 with Option 2 and/or Option 3, as appropriate, to ensure that adequate terrorist ties checks are performed on different types of affected individuals (e.g., employees, contractors, unescorted visitors). Each high-risk chemical facility will need to describe how it will comply with RBPS 12(iv) in its SSP or ASP. In addition to the options described above for satisfying RBPS 12(iv), high-risk chemical facilities are welcome to propose alternative or supplemental options not described in this PRA notice in their SSPs or ASPs. The Department will assess the adequacy of such alternative or supplemental options on a facility-by-facility basis, in the course of evaluating each facility's SSP or ASP. Although outside the scope of this PRA notice and the underlying ICR, the Department would like to highlight that high-risk chemical facilities also have other methods to address, or minimize the impacts of, compliance with RBPS 12(iv). For example, facilities may restrict the numbers and types of persons whom they allow to access their restricted areas and critical assets, thus limiting the number of persons who will need to be checked for terrorist ties. Facilities also have wide latitude in how they define their restricted areas and critical assets in their SSPs or ASPs, thus potentially limiting the number of persons who will need to be checked for terrorist ties. High-risk chemical facilities also may choose to escort visitors to restricted areas and critical assets in lieu of performing the background checks required by RBPS 12. For example, high-risk chemical facilities could propose in their SSPs or ASPs traditional escorting solutions and/or innovative escorting alternatives such as video monitoring (which may reduce facility security costs), as appropriate, to address the unique security risks present at each facility. Summary of Options Available to High-Risk Chemical Facilities To Comply With RBPS 12(iv) The purpose of the CFATS Personnel Surety Program is to identify individuals with terrorist ties that have or are seeking access to the restricted areas and/or critical assets at the nation's high-risk chemical facilities. As described above, under the CFATS Personnel Surety Program, for each affected individual a high-risk chemical facility would have at least three options under RBPS 12(iv): • OPTION 1—DIRECT VETTING: High-risk chemical facilities (or their designees) may submit information to the Department about an affected individual to be compared against information about known or suspected terrorists, and/or • OPTION 2 -USE OF VETTING CONDUCTED UNDER OTHER DHS PROGRAMS: High-risk chemical facilities (or their designees) may submit information to the Department about an affected individual's enrollment in another DHS program so that the Department may electronically verify and validate that the affected individual is enrolled in the other program, and/or • OPTION 3—ELECTRONIC VERIFICATION OF TWIC: High-risk chemical facilities may electronically verify and validate an affected individual's TWIC, through the use of TWIC readers (or other technology which is periodically updated with revoked card information), rather than submitting information about the affected individual to the Department. Regardless of the option, in the event that there is a potential match, the Department has procedures in place that it will follow to resolve the match and coordinate with appropriate law enforcement entities as necessary. The Department intends to provide high-risk chemical facilities, and their designees, the ability to create an alert within the CSAT Personnel Surety application that can notify them when the Department has received information about an affected individual(s), under Option 1 or Option 2. Further, the Department will also allow high-risk chemical facilities the ability to view the status (e.g., that some information about an affected individual has been inputted into CSAT but not yet submitted to the Department under Option 1 or Option 2; that information about an affected individual has been submitted; etc.) of records about affected individuals associated with their facility within the CSAT Personnel Surety application. Scope of This Notice and Commitment To Explore Additional Options in the Future Between August 2012, and publication of the 60-day notice in March 2013, the Department had substantial dialogue with key CFATS stakeholders. The discussion included program design issues, the CSAT Personnel Surety application, options the Department has been considering to date, and additional options stakeholders have recommended for the Department's consideration, both in the short and long term. The options described in this notice and, if approved, the ICR that the Department will submit to OMB would allow high-risk chemical facilities and the Department to implement the CFATS Personnel Surety Program within the Department's existing statutory and regulatory authority, and U.S. Government watchlisting policies. The Department is committed, however, to continuing to work with interested stakeholders to identify additional potential options that could further reduce the burdens related to the CFATS Personnel Surety Program, while still meeting the national security mandate to reduce the risk of an individual with terrorist ties obtaining access to the restricted areas or critical assets at a high-risk chemical facility. The Department will consider and review any alternatives suggested as part of public comments on this notice. Through both the PRA process and other ongoing dialogues, the Department will, as appropriate, also continue to work with stakeholders to identify potential additional alternatives as new technologies emerge, and as other terrorist ties vetting programs are modified or become available over time, so as to reduce the burden of this new information collection. Who is Impacted by the CFATS Personnel Surety Program? The CFATS Personnel Surety Program will provide high-risk chemical facilities the ability to submit certain biographic information about affected individuals to the Department. As explained above, affected individuals are (1) facility personnel who have access, either unescorted or otherwise, to restricted areas or critical assets, and (2) unescorted visitors who have access to restricted areas or critical assets. There are also certain groups of persons that the Department does not consider to be affected individuals, such as (1) Federal officials that gain unescorted access to restricted areas or critical assets as part of their official duties; (2) state and local law enforcement officials that gain unescorted access to restricted areas or critical assets as part of their official duties; and (3) emergency responders at the state or local level that gain unescorted access to restricted areas or critical assets during emergency situations. In some emergency or exigent situations, access to restricted areas or critical assets by other individuals who have not had appropriate background checks under RBPS 12 may be necessary. For example, emergency responders not described above may require such access as part of their official duties under appropriate circumstances. If high-risk chemical facilities anticipate that any individuals will require access to restricted areas or critical assets without visitor escorts or without the background checks listed in RBPS 12 under exceptional circumstances (e.g., foreseeable but unpredictable circumstances), facilities may describe such situations and the types of individuals who might require access in those situations in their SSPs or ASPs. The Department will assess the appropriateness of such situations, and any security measures to mitigate the inherent vulnerability in such situations, on a case-by-case basis as it reviews each high-risk chemical facility's SSP or ASP. What/Who is the Source of the Information Under Option 1 And Option 2 High-risk chemical facilities are responsible for complying with RBPS 12(iv). However, companies operating multiple high-risk chemical facilities, as well as companies operating only one high-risk chemical facility, may comply with RBPS 12(iv) in a variety of ways. High-risk chemical facilities, or their parent companies, may choose to comply with RBPS 12(iv) by identifying and submitting the information about affected individuals to the Department directly. Alternatively, high-risk chemical facilities, or their parent companies, may choose to comply with RBPS 12(iv) by outsourcing the information submission process to third parties. The Department anticipates that many high-risk chemical facilities will rely on businesses that provide contract services (e.g., complex turn-arounds, freight delivery services, lawn mowing) to the high-risk chemical facilities to identify and submit the appropriate information about affected individuals they employ to the Department for vetting pursuant to RBPS 12(iv). Businesses that provide services to high-risk chemical facilities may in turn choose to manage compliance with RBPS 12(iv) themselves or to acquire the services of other third party companies to submit appropriate information about affected individuals to the Department. CSAT User Roles and Responsibilities To minimize the burden of submitting information about affected individuals, under Options 1 and 2 (as described above), high-risk chemical facilities would have wide latitude in assigning CSAT user roles to align with their business operations and/or the business operations of third parties that provide contracted services to them. 13 Furthermore, the Department intends to structure the CSAT Personnel Surety application to allow designees of high- risk chemical facilities to submit information about affected individuals directly to the Department on behalf of high-risk chemical facilities. 13 CSAT user registration and the assignment of user roles within CSAT are covered under a different Information Collection (i.e., 1670-0007), which can be found at http://www.reginfo.gov/public/do/PRAViewICR?ref_nbr=201001-1670-007# . High-risk chemical facilities and their designees will be able to structure their CSAT user roles to submit information about affected individuals to the Department in several ways: (1) A high-risk chemical facility could directly submit information about affected individuals, and designate one or more officers or employees of the facility with appropriate CSAT user roles; and/or (2) A high-risk chemical facility could ensure the submission of information about affected individuals by designating one or more persons affiliated with a third party (or with multiple third parties); and/or (3) A company owning several high-risk chemical facilities could consolidate its submission process for affected individuals. Specifically, the company could designate one or more persons to submit information about affected individuals on behalf of all of the high-risk chemical facilities on a company-wide basis. The Department may, upon request, also consider allowing CSAT users with the ability to submit information about affected individuals to the Department via a Web-service. The ability to submit information about affected individuals via a Web-service will be provided on a case by cases basis, when in the opinion of the Department, sufficient additional security and privacy safeguards have been agreed to by the CSAT user. 14 14 A Web-service is software system designed to support interoperable machine-to-machine interaction over a network. Burden Resulting From the Submission of Duplicate Records About an Affected Individual The Department is aware that an affected individual may be associated with multiple high-risk chemical facilities, and thus information about an affected individual may be submitted to the Department multiple times by different high-risk chemical facilities and/or their designated third parties. However, the Department has learned in its dialogue with stakeholders (including third-party companies that conduct background checks for high-risk chemical facilities) that the duplicate submission of records about affected individuals is a common industry practice for companies when managing information about individuals. Specifically, when a person who has already had a background check (e.g., verification of legal authorization to work or criminal history) needs a new background check for different companies or for a new or different purpose (e.g., change in jobs or contract), third parties that routinely conduct background checks routinely will submit information about a person again to agencies responsible for maintaining relevant information (e.g., state government agencies responsible for maintaining state motor vehicle databases). Therefore, for the purpose of this notice, the Department's estimation of burden accounts for potential multiple submissions of information about affected individuals by high-risk chemical facilities and their designated third parties. Compliance With RBPS 12(iv) and the Potential for Increased Burden To Enter the Restricted Areas or Critical Assets at a High-Risk Chemical Facility Since the Department first began seeking to implement the CFATS Personnel Surety Program, stakeholders have expressed concern that the submission of information about affected individuals under Option 1 and Option 2 to the Department would impede the ability of affected individuals to enter the restricted areas or critical assets at high-risk chemical facilities. The Department does not believe that if a facility complies with RBPS 12(iv) the high-risk chemical facility will, on a routine basis, experience an unreasonable impact in allowing affected individuals access to restricted areas or critical assets. In general, the Department expects that high-risk chemical facilities or their designees (e.g., third parties or companies employing affected individuals that provide services to high-risk chemical facilities) will already possess much, if not all, of the necessary information about affected individuals as a result of standard business practices related to employment or managing of service contracts. In the event that high-risk chemical facilities, or their designees, need to collect any additional information for the purpose of complying with RBPS 12(iv), they have significant flexibility in how to collect this information since CFATS does not prescribe how to do so. The Department also expects that high-risk chemical facilities will likely consolidate RBPS 12(iv) processing with related routine hiring and access control procedures involving background checks that are already occurring prior to access by facility personnel or unescorted visitors to restricted areas or critical assets. Consolidating RBPS 12(iv) processing with these other routine procedures would allow submission of personal information already collected and maintained by facilities or their designees (e.g., a third party, contracted service company, or third party acting on behalf of a contracted service company) to the Department under RBPS 12(iv) before affected individuals require access to restricted areas or critical assets. As mentioned above, third parties could submit screening information to the Department on behalf of high-risk chemical facilities as part of facilities' routine hiring and access control procedures. Some stakeholders have expressed concerns to the Department about submission of screening information by third parties, suggesting that in such cases facilities would not be able to adequately oversee third parties' work to ensure appropriate information submission to the Department. The Department expects, however, that high-risk chemical facilities could audit and/or review their third party designees' information collection and submission processes, to ensure that their designees submit appropriate information. The Department has provided below several illustrative examples about how high-risk chemical facilitates or designees are likely to consolidate RBPS 12(iv) processing with routine background check activities related to those required by RBPS 12(i)-(iii), namely, (i) measures designed to verify and validate identity; (ii) measures designed to check criminal history; and (iii) measures designed to verify and validate legal authorization to work. By consolidating RBPS 12(iv) with routine background check activities related to RBPS 12(i)-(iii), high-risk chemical facilities will likely choose to incorporate the submission of information about affected individuals to the Department under RBPS 12(iv) into the routine background check activities required by RBPS 12(i)-(iii). Although estimating the burden of RBPS 12(i)-(iii) is not within the scope of this Paperwork Reduction Act notice, when and how high-risk chemical facilities could collect information for submission to the Department has influenced the Department's design of the CFATS Personnel Surety Program. The Department believes that the illustrative examples provided below show how, if the CFATS Personnel Surety Program is implemented, a high-risk chemical facility and its associated third party companies could access the CSAT Personnel Surety application for purposes of submitting terrorist ties screening information to the Department on its behalf under RBPS 12(iv), in coordination with other normal business activities not required by RBPS 12(iv). SCENARIO #1: Employees Who Are “Facility Personnel” This scenario could apply to a high-risk chemical facility that has a number of employees it deems in its SSP or ASP to be “facility personnel” with access to restricted areas and/or critical assets. In its SSP or ASP, the high-risk chemical facility could choose to comply with RBPS 12(i)-(iii) for these employees by either: • Hiring a third party background check company to perform identity, criminal history, and legal authorization to work background checks on these employees. ○ A contract or agreement between the high-risk chemical facility and the third party could establish the criteria for these background checks, and could establish which background check results qualify individuals to access the restricted areas or critical assets at the high-risk chemical facility or disqualify individuals from accessing the restricted areas or critical assets at the high-risk chemical facility. ○ The third party could submit appropriate information, under Option 1 and/or Option 2, to the Department while it conducts these identity, criminal history, and legal authorization to work background checks. ○ The high-risk chemical facility could audit or review the background checks being conducted to ensure contractual compliance. Or, • Performing identity, criminal history, and legal authorization to work background checks itself. ○ The high-risk chemical facility could establish the criteria for these background checks, and could establish which background check results qualify individuals to access the restricted areas or critical assets at the high-risk chemical facility or disqualify individuals from accessing the restricted areas or critical assets at the high-risk chemical facility. ○ The facility could submit appropriate information, under Option 1 and/or Option 2, to the Department while it conducts these identity, criminal history, and legal authorization to work background checks. Prior to an employee being granted access to restricted areas or critical assets (i.e., prior to being issued a facility-specific access credential/card, or door/gate key(s)), identity, criminal history, and legal authorization to work background checks could be completed by the third party or the high-risk chemical facility in accordance with the high-risk chemical facility's SSP or ASP. If appropriate, based upon the results of those background checks, the employee could then be determined suitable to access the high-risk chemical facility's restricted areas and/or critical assets. The third party or the high-risk chemical facility could then report its suitability finding to the appropriate party at the high-risk chemical facility so that facility-specific access credentials/cards, or door/gate key(s) could be granted, if appropriate. Completion of submission of information about the affected individual to the Department in compliance with RBPS 12(iv) therefore would not impede the routine access control procedures of the high-risk chemical facility because the information submission would likely be accomplished in concert with the other background check activities, prior to access. SCENARIO #2: Resident Contractors Who Are “Facility Personnel” This scenario could apply to a high-risk chemical facility that has a number of resident contractors it deems in its SSP or ASP to be “facility personnel” with access to restricted areas or critical assets. In its SSP or ASP, the high-risk chemical facility could choose to comply with RBPS 12(i)-(iii) for resident contractors by: • Stipulating in a contract between the high-risk chemical facility and the company employing the resident contractors that the contractors' employer will perform or provide for identity, criminal history, and legal authorization to work background checks to be conducted on the resident contractors. ○ A contract or agreement between the high-risk chemical facility and the company employing the resident contractors could establish the criteria for these background checks, and could establish which background check results qualify individuals to access the restricted areas or critical assets at the high-risk chemical facility or disqualify individuals from accessing the restricted areas or critical assets at the high-risk chemical facility. ○ The high-risk chemical facility could audit or review the background checks being conducted to ensure contractual compliance. • Prior to a resident contractor being granted access to the restricted areas or critical assets of the high-risk chemical facility (i.e., being issued a facility-specific access credential/card, door/gate key(s)), identity, criminal history, and legal authorization to work background checks could be completed by the company employing the resident contractor in accordance with the high-risk chemical facility's SSP or ASP. ○ The company employing the resident contractor could conduct these identity, criminal history, and legal authorization to work background checks. ○ The company employing the resident contractor could submit appropriate information, under Option 1 and/or Option 2, to the Department while it conducts these identity, criminal history, and legal authorization to work background checks. • The company employing the resident contractor, however, might not perform the actual background checks itself. Rather, the company employing the resident contractor could hire a third party background check company to perform identity, criminal history, and legal authorization to work background checks on its employees (including the resident contractors at the high-risk chemical facility). ○ If the company employing the resident contractor hires a third party background check company for this purpose, a contract or agreement between the company employing the resident contractor and the third party background check company could establish the criteria for these background checks and could establish which background check results are acceptable for access to the restricted areas and critical assets at the high-risk chemical facility for which the resident contractor performs services. ○ The third party background check company could submit appropriate information, under Option 1 and/or Option 2, to the Department while it conducts these identity, criminal history, and legal authorization to work background checks. Prior to the resident contractor being granted access to restricted areas or critical assets of the high-risk chemical facility (i.e., being issued a facility-specific access credential/card, or door/gate key(s)), identity, criminal history, and legal authorization to work background checks could be completed by the company employing the resident contractor, or by a third party background check company in accordance with the high-risk chemical facility's SSP or ASP. If appropriate, based on the results of those background checks, the resident contractor could then be determined suitable to access the high-risk chemical facility's restricted areas and/or critical assets. The company employing the resident contractor, or a third party background check company, could then report suitability findings to the high-risk chemical facility. The appropriate party at the high-risk chemical facility could then grant the resident contractor facility-specific access credentials/cards, or door/gate key(s), if appropriate based on those suitability findings. The submission of information about the affected individual to the Department in compliance with RBPS 12(iv) therefore would not impede the routine access control procedures of the high-risk chemical facility because the submission of information would likely be accomplished in concert with the other background check activities, prior to access. SCENARIO #3: Frequent “Unescorted Visitors” This scenario could apply to a high-risk chemical facility that has a number of frequent unescorted visitors that have or are seeking repeated access to the restricted areas or critical assets of the facility, pursuant to a contractual relationship with a company employing the frequent unescorted visitors. In its SSP or ASP, the high-risk chemical facility could choose to comply with RBPS 12(i)-(iii) for frequent unescorted visitors by: • Stipulating in a contract between the high-risk chemical facility and the company employing the frequent unescorted visitors that the frequent unescorted visitors' employer will perform or provide for identity, criminal history, and legal authorization to work background checks to be conducted on the frequent unescorted visitors. ○ A contract or agreement between the high-risk chemical facility and the company employing the frequent unescorted visitors could establish the criteria for these background checks, and could establish which background check results qualify individuals to access the restricted areas or critical assets at the high-risk chemical facility or disqualify individuals from accessing the restricted areas or critical assets at the high-risk chemical facility. ○ The high-risk chemical facility could audit or review the background checks being conducted to ensure contractual compliance. • Prior to a frequent unescorted visitor being granted access to the restricted areas or critical assets of the facility (i.e., being issued a facility-specific access credential/card, door/gate key(s)), identity, criminal history, and legal authorization to work background checks could be completed by the company employing the frequent unescorted visitor in accordance with the high-risk chemical facility's SSP or ASP. ○ The company employing the frequent unescorted visitor could conduct these identity, criminal history, and legal authorization to work background checks. ○ The company employing the frequent unescorted visitor could submit appropriate information, under Option 1 and/or Option 2, to the Department while it conducts these identity, criminal history, and legal authorization to work background checks. • The company employing the frequent unescorted visitor, however, might not perform the actual background checks itself. Rather, the company employing the frequent unescorted visitor could hire a third party background check company to perform identity, criminal history, and legal authorization to work background checks on its employees (including the frequent unescorted visitors that access the restricted areas or critical assets of a high-risk chemical facility). ○ If the company employing the frequent unescorted visitor hires a third party background check company for this purpose, a contract or agreement between the company employing the frequent unescorted visitor and the third party background check company could establish the criteria for these background checks and could establish which background check results are acceptable for access to the restricted areas and critical assets at the high-risk chemical facility for which the frequent unescorted visitor performs services. ○ The third party background check company could submit appropriate information, under Option 1 and/or Option 2, to the Department while it conducts these identity, criminal history, and legal authorization to work background checks. Prior to the frequent unescorted visitor being granted access to restricted areas or critical assets of the high-risk chemical facility (i.e., being issued a facility-specific access credential/card, or door/gate key(s)), identity, criminal history, and legal authorization to work background checks could be completed by the company employing the frequent unescorted visitor, or by a third party background check company in accordance with the high-risk chemical facility's SSP or ASP. If appropriate based on the results of those background checks, the frequent unescorted visitor could then be determined suitable to access the restricted areas or critical assets at the high-risk chemical facility. The company employing the frequent unescorted visitor, or a third party background check company, could then report suitability findings to the high-risk chemical facility. The appropriate party at the high-risk chemical facility could then grant the frequent unescorted visitor facility-specific access credentials/cards, or door/gate key(s), if appropriate based on those suitability findings. The submission of information about the affected individual to the Department in compliance with RBPS 12(iv) therefore would not impede the routine access control procedures of the high-risk chemical facility because the information submission would likely be accomplished in concert with the other background check activities, prior to access. SCENARIO #4: Infrequent “Unescorted Visitors” Since the Department first began developing the CFATS Personnel Surety Program, some stakeholders have expressed concern that the submission of information to DHS about unescorted visitors who have only rare or infrequent access to high-risk chemical facilities would be overly burdensome and would make access by such infrequent unescorted visitors too difficult. As a general matter, however, the Department does not believe it likely that many high-risk chemical facilities will propose in their SSPs or ASPs to allow large numbers of visitors who visit the high-risk chemical facility infrequently to have unescorted access to restricted areas and critical assets, because then all four types of background checks listed in RBPS 12 would be required to be conducted for them. High-risk chemical facilities could choose to escort infrequent visitors in lieu of performing the four types of RBPS 12 background checks on them. However, even for infrequent unescorted visitors on whom the high-risk chemical facility chooses to conduct all four types of background checks, the Department does not expect data submission to the Department in compliance with RBPS 12(iv) to impede routine access procedures because the data submission is likely to be accomplished in concert with the other routine hiring and access control background checks related to RBPS 12(i)-(iii) described above. The Department believes that the data submission for RBPS 12(iv) will likely be accomplished in concert with the routine hiring and access control background checks related to RBPS 12(i)-(iii) because doing them in concert is likely to generate the potential for cost savings. 15 15 This ICR does not estimate the potential cost savings high-risk chemical facilities or their designees could achieve as a result of submitting data in concert with the other routine hiring and access control background checks related to RBPS 12(i)-(iii) because the scope of this ICR is limited to the Departments obligation to estimate the burden of submitting information about affected individuals to identify terrorist ties under RBPS 12(iv) in accordance with the Paperwork Reduction Act. Additional Data Privacy Considerations There are various privacy requirements for high-risk chemical facilities, their designees, and the Department related to the exchange of personally identifiable information (PII) for the CFATS Personnel Surety Program. Upon receipt of PII, the Department complies with all applicable federal privacy requirements including those contained in the Privacy Act, the E-Government Act, the Homeland Security Act, and Departmental policy. The United States also follows international instruments on privacy, all of which are consistent with the Fair Information Practice Principles (FIPPs). 16 High-risk chemical facilities, or their designees, are responsible for complying with the federal, state, and national privacy laws applicable to the jurisdictions in which they do business. The Department believes that high-risk chemical facilities, or their designees, have multiple, established legal avenues that enable them to submit PII to the Department, which may include the Safe Harbor Framework, 17 and meet their privacy obligations. 16 Examples of the international privacy instruments which the United States has endorsed are: (1) Organization for Economic Cooperation and Development (OECD) Guidelines on the Protection of Privacy and Trans-border Flows of Personal Data (1980), and (2) Asia Pacific Economic Cooperation (APEC) Privacy Framework (2004). 17 The Safe Harbor Framework, which applies to commercial information, was developed by the U.S. Department of Commerce in consultation with the European Commission in order to provide a streamlined means for U.S. organizations to comply with the European Union Data Protection Directive 95/46/EC. More information on the Safe Harbor Framework can be found at http://export.gov/safeharbor. II. Information Collected About Affected Individuals Option 1: Collecting Information To Conduct Direct Vetting If high-risk chemical facilities select Option 1 to satisfy RBPS 12(iv) for any affected individuals, the following information about these affected individuals would be submitted to the Department: • For U.S. Persons (U.S. citizens and nationals as well as U.S. lawful permanent residents): ○ Full Name ○ Date of Birth ○ Citizenship or Gender • For Non-U.S. Persons: ○ Full Name ○ Date of Birth ○ Citizenship ○ Passport information and/or alien registration number To reduce the likelihood of false positives in matching against records in the federal government's consolidated and integrated terrorist watchlist, high-risk chemical facilities would also be able to submit the following optional information about affected individuals to the Department: • Aliases • Gender (for Non-U.S. Persons) • Place of Birth • Redress Number 18 18 For more information about Redress Numbers, please go to http://www.dhs.gov/one-stop-travelers-redress-process#1. If a high-risk chemical facility chooses to submit information about an affected individual under Option 1, the following table summarizes the biographic data that would be submitted to the Department. Table 1—Affected Individual Required and Optional Data Under Option 1 Data elements submitted to the department For a U.S. person For a non-U.S. person Full Name Required Date of Birth Required Gender Must provide Citizenship or Gender Optional. Citizenship Required. Passport Information and/or Alien Registration Number N/A Required. Aliases Optional Place of Birth Optional Redress number Optional Option 2: Collecting Information To Use Vetting Conducted Under Other DHS Programs In lieu of submitting information to the Department under Option 1 for terrorist ties vetting, chemical facilities would also have the option, where appropriate, to submit information to the Department to electronically verify that an affected individual is currently enrolled in one of the following DHS programs: • TWIC Program; • HME Program; • Trusted Traveler Programs, including: ○ NEXUS; ○ FAST; ○ SENTRI; and ○ Global Entry. Information collected by the Department about affected individuals under Option 2 would not be used to conduct duplicative vetting against the federal government's consolidated and integrated terrorist watchlist. To verify an affected individual's enrollment in one of these programs under Option 2, the Department would collect the following information about the affected individual: • Full Name; • Date of Birth; and • Program-specific information or credential information, such as unique number, or issuing entity (e.g., State for Commercial Driver's License (CDL) associated with an HME). To further reduce the potential for misidentification, high-risk chemical facilities may also submit the following optional information about affected individuals to the Department: • Aliases • Gender • Place of Birth • Citizenship If a high-risk chemical facility chooses to submit information about an affected individual under Option 2, the following table summarizes the biographic data that would be submitted to the Department. Table 2—Affected Individual Required and Optional Data Under Option 2 Data elements submitted to the department For affected individual with a TWIC For affected individual with an HME For affected individual enrolled in a trusted traveler programs (NEXUS, SENTRI, FAST, or global entry) Full Name Required Date of Birth Required Expiration Date Required Unique Identifying Number TWIC Serial Number: Required CDL Number: Required PASS ID Number: Required. Issuing State of CDL N/A Required N/A. Aliases Optional Gender Optional Place of Birth Optional Citizenship Optional Under the CFATS Personnel Surety Program, a high-risk chemical facility would be able to choose to follow the process described for Option 1, and would not have to implement Option 2, even if an affected individual seeking access to the high-risk chemical facility is already enrolled in the TWIC Program, HME Program, or one of the Trusted Traveler Programs. Option 3: Electronic Verification of TWIC Under Option 3, a high-risk chemical facility would not need to submit information about an affected individual enrolled in the TWIC Program to the Department, if the high-risk chemical facility is able to electronically verify and validate the affected individual's TWIC through the use of a TWIC reader (or other technology that is periodically updated with revoked card information). As discussed above, under the CFATS Personnel Surety Program, high-risk chemical facilities would also be able to choose to follow the processes described for Option 1 and/or Option 2, for some or all affected individuals already enrolled in the TWIC Program, in lieu of or in addition to Option 3. Other Information Collected In addition to the information about affected individuals collected under Options 1 and 2, the Department plans to collect certain information that identifies the high-risk chemical facility, or facilities, at which each affected individual has or is seeking access to restricted areas or critical assets. The Department may also contact a high-risk chemical facility or its designees to request additional information (e.g., visa information) pertaining to affected individuals in order to clarify suspected data errors or resolve potential matches (e.g., in situations where an affected individual has a common name). Such requests will not imply, and should not be construed to indicate, that an affected individual's information has been confirmed as a match to a record of an individual with terrorist ties. In the event that a confirmed match is identified as part of the CFATS Personnel Surety Program, the Department may obtain references to and/or information from other government law enforcement and intelligence databases, or other relevant databases that may contain terrorism information. The Department may collect information necessary to assist in the submission and transmission of records, including electronic verification that the Department has received a particular record. The Department may also collect information about points of contact who the Department or federal law enforcement personnel may contact with follow-up questions. A request for additional information from the Department does not imply, and should not be construed to indicate, that an individual is known or suspected to be associated with terrorism. The Department may also collect information provided by individuals or high-risk chemical facilities in support of any adjudications requested under Subpart C of the CFATS regulation, 19 or in support of any other redress requests. 20 19 See 6 CFR 27.300-345. 20 More information about access, correction, and redress requests under the Freedom of Information Act and the Privacy Act can be found in Section 7.0 of the Privacy Impact Assessment for the CFATS Personnel Surety Program, dated May 4, 2011, and available at http://www.dhs.gov/xlibrary/assets/privacy/privacy-pia-nppd-cfats-ps.pdf. The Department may request information pertaining to affected individuals, previously provided to the Department by high-risk chemical facilities or their designees, in order to confirm the accuracy of that information, or to conduct data accuracy reviews and audits as part of the CFATS Personnel Surety Program. The Department will also collect administrative or programmatic information (e.g., affirmations or certifications of compliance, extension requests, brief surveys for process improvement) necessary to manage the CFATS Personnel Surety Program. Under Options 1 and 2, the Department will also collect information that will allow high-risk chemical facilities and their designees to manage their data submissions. Specifically, the Department will make available to high-risk chemical facilities and their designees blank data fields. These blank data fields may be used by a high-risk chemical facility or its designees to assign each record of an affected individual a unique designation or number that is meaningful to the high-risk chemical facility. Collecting this information will enable a high-risk chemical facility to manage the electronic records it submits into the CSAT Personnel Surety application. Entering this information into the CSAT Personnel Surety application will be voluntary, and is intended solely to enable high-risk chemical facilities and their designees to search through, sort, and manage the electronic records they submit. III. Request for Exception to the Requirement Under 5 CFR 1320.8(b)(3) The Department is requesting from OMB an exception for the CFATS Personnel Surety Program to the PRA notice requirement in 5 CFR 1320.8(b)(3), which requires federal agencies to confirm that their information collections provide certain reasonable notices under the PRA to affected individuals. If this exception is granted, the Department will be relieved of the potential obligation to require high-risk chemical facilities to collect signatures or other positive affirmations of these notices from affected individuals. Whether or not this exception is granted, Submitters must affirm that the required privacy notice regarding the collection of personal information has been provided to affected individuals before personal information is submitted to the Department. 21 21 For more information, please see the Privacy Impact Assessment for the CFATS Personnel Surety Program, dated May 4, 2011 and available at http://www.dhs.gov/xlibrary/assets/privacy/privacy-pia-nppd-cfats-ps.pdf. The Department's request for an exception to the PRA notice requirement under 5 CFR 1320.8(b)(3) would not exempt high-risk chemical facilities from having to adhere to applicable federal, state, local, or tribal laws, or to regulations or policies pertaining to the privacy of affected individuals. IV. Responses to Comments Submitted During 60-Day Comment Period The Department solicited comments on four questions: (1) Evaluate whether the proposed collection of information is necessary for the proper performance of the functions of the agency, including whether the information will have practical utility; (2) Evaluate the accuracy of the agency's estimate of the burden of the proposed collection of information, including the validity of the methodology and assumptions used; (3) Enhance the quality, utility, and clarity of the information to be collected; and (4) Minimize the burden of the collection of information on those who are to respond, including through the use of appropriate automated, electronic, mechanical, or other technological collection techniques or other forms of information technology, e.g., permitting electronic submissions of responses. In response to the 60-day notice that solicited comments about the CFATS Personnel Surety Program ICR, the Department received 28 comments from 2 private citizens, 8 private sector companies 22 , 14 trade associations, 1 union, 1 training council, and the Ranking Member of the House of Representatives Committee on Homeland Security. 22 One private sector company submitted two distinct comments. Comments Related to Whether the Proposed Collection of Information is Necessary for the Proper Performance of the Functions of the Agency, Including Whether the Information Will Have Practical Utility The Department did not receive any comments suggesting that the proposed collection of information was not necessary for the proper performance of the functions of the agency. Comments Related to the Accuracy of the Agency's Estimate of the Burden of the Proposed Collection of Information, Including the Validity of the Methodology and Assumptions Used Comment: Several commenters suggested that the annual turnover rate of 71% for frequent unescorted visitors estimated by the Department in the 60-day notice underestimated the annual turnover rate for delivery personnel. 23 One commenter suggested that the Department adopt a higher annual turnover rate of 81.75% for all frequent unescorted visitors. 23 See Table 6 in the 60-day notice published on March 22, 2013 at 78 FR 17690. Response: The Department agreed to adopt the higher estimated rate for frequent unescorted visitor annual turnover of 81.75%. The Department's burden estimates reflect this revised assumption. Comment: One commenter suggested that the Department made an error in Table 18 of the 60-day notice by not differentiating between the turnover rates of employees, frequent visitors, and infrequent visitors. Response: In this notice, the Department explicitly distinguishes the turnover rates of employees, frequent visitors, and infrequent visitors when estimating the annual burden estimate. Comment: One commenter suggested that the Department did not accurately estimate the annual burden estimate in Table 19 of the 60-day notice. Specifically, the commenter suggested that Table 19 of the 60-day notice reflects a figure “0.50” hours for initial submission rather than “0.5425” hours which was the estimated time per respondent calculated in Table 18 of the 60-day notice. Response: The Department disagrees and believes that in Table 19 it was accurate to use the figure “0.50” hours when estimating the annual burden. The figure 0.50 hours is distinct and is only associated with initial submission and not the other types of transactions covered by the ICR such as updates, corrections, and removals. The figure 0.5425 hours represented the weighted average of all types of transactions and thus would have been inappropriate to use in Table 19 of the 60-day notice when estimating the annual burden. Comment: One commenter suggested that the Department did not account for costs imposed by information submission requests the Department may require. Specifically, when the Department “may” require facilities to provide other pieces of information pertaining to affected individuals including visa information, the submission and transmission of records such as electronic verification that the facility provided a particular record, points of contact at a facility, and information supporting any adjudications or redress requests. Response: In the 60-day notice, Department estimated the average time per respondent to be 0.54 hours. The Department believes that the burden associated with requests from the Department for additional information about the affected individuals will be very rare and thus de minimus in nature. The Department also believes that the burden associated with information requests to support adjudication or redress requests will also be very rare and thus de minimus as well. Finally, the Department will collect submission and transmission of records, including electronic verification that the Department has received a particular record, automatically via system log files. This collection will not impose a burden on the high-risk chemical facility or designee. Therefore, for the reasons expressed above, the Department believes it has accurately estimated the estimated time per respondent. Comment: One commenter states that the Department did not account for the cost facilities will incur for a “facility-by-facility vetting of individuals accessing multiples facilities.” Response: As mentioned earlier in this notice, the Department is aware that an affected individual may be associated with multiple high-risk chemical facilities, and thus information about an affected individual may be submitted to the Department multiple times by different high-risk chemical facilities and/or their designated third parties. Therefore, for the purposes of this notice, the Department's estimation of burden accounts for the notion that an affected individual's information may be submitted by multiple times by high-risk chemical facilities and their designated third parties. Comment: Several commenters objected to the Department's assumptions related to the potential recordkeeping burden associated with RBPS 12(iv). Namely, they objected to the idea that no potential recordkeeping should be estimated in this notice in accordance with 5 CFR 1320.3(b)(2), which directs federal agencies to not count the costs associated with the time, effort, and financial resources incurred in the normal course of their activities (e.g., in compiling and maintaining business records) if the reporting, recordkeeping, or disclosure activities are usual and customary. Furthermore, commenters objected to the Department's belief that the types of recordkeeping associated with RBPS 12(iv) are usual and customary costs that high-risk chemical facilities would incur to conduct background checks for identity, criminal history, and legal authorization to work as required by RBPS 12(i)-(iii) and also by various other federal, state, or local laws or regulations. Response: As mentioned earlier in this notice, the Department expects that high-risk chemical facilities or their designees (e.g., third parties or companies employing affected individuals that provide services to high-risk chemical facilities) will already possess much, if not all, of the necessary information about affected individuals as a result of standard business practices related to employment or managing of service contracts. Furthermore, the Department also expects that high-risk chemical facilities will likely consolidate RBPS 12(iv) processing with related routine hiring and access control procedures involving background checks that are already occurring prior to access by facility personnel or unescorted visitors to restricted areas or critical assets. Consolidating RBPS 12(iv) processing with these other routine procedures would allow submission of personal information already collected and maintained by facilities or their designees (e.g., a third party, contracted service company, or third party acting on behalf of a contracted service company) to the Department under RBPS 12(iv). In this notice, the Department provides several illustrative examples to further clarify the Department's continued belief that the types of recordkeeping associated with RBPS 12(iv) are usual and customary costs that high-risk chemical facilities (or designees) would incur to conduct background checks for identity, criminal history, and legal authorization to work as required by RBPS 12(i)-(iii). Comments Related to the Quality, Utility, and Clarity of the Information to be Collected Comment: One commenter requested specifics about the mechanics of the process on how to submit information about affected individuals to the Department. Response: The Department will publish a user manual when the CFATS Personnel Surety Program is implemented. The user manual will contain the necessary details about how information about affected individuals may be submitted, under Option1 or Option 2, through CSAT to the Department. Comment: One commenter requested specific information about the security or information protection requirements necessary to serve as a Submitter. Response: While an owner or operator of a chemical facility may designate someone to submit information on its behalf, the owner or operator is responsible for satisfying all the requirements of 6 CFR 27.230(a)(12)(iv). The Department provides at 6 CFR 27.200(b)(3) that any such submitter must be an officer of the corporation or other person designated by an officer of the corporation, and must be domiciled in the United States, and is responsible for attesting to the accuracy of the submitted information. When a high-risk chemical facilities relies on third party companies to submit appropriate information about affected individuals to the Department the same requirements will apply. The submitter(s) must be designated by an officer of the corporation, must be domiciled in the United States, and is responsible for attesting to the accuracy of the submitted information. Comments Related to Minimizing the Burden of the Collection of Information on Those Who are to Respond, Including Through the Use of Appropriate Automated, Electronic, Mechanical, or Other Technological Collection Techniques or Other Forms of Information Technology, e.g., Permitting Electronic Submissions of Responses Comment: One commenter requested the ability to submit information about affected individuals “via some type of file (spreadsheet) upload as opposed to direct data entry into CSAT.” Response: When implemented, high-risk chemical facilities (and their designees), under Option 1 and Option 2, will have the ability to input records about affected individuals in three ways: (1) Manual entry, (2) bulk upload via Microsoft Excel file or an Extensible Markup Language (XML) file, and (3) a direct Web Service connection. Comment: One commenter requested clarification about Option 3, specifically, if the phrase “other technology” means computer access to the Internet. Response: The Department's phrase “other technology which is periodically updated using the CCL” was intended to cover a variety of ways a high-risk chemical facility could, in its SSP or ASP, describe how it would determine if a TWIC was revoked for cause, or revoked because it was reported lost or stolen. Revoked cards could be determined from the CCL by using an electronic card reader to compare the TWIC's Federal Agency Smart Credential Number (FASC-N) to those listed on the CCL. This could be accomplished by periodically downloading the current CCL from the Internet to either a TWIC reader or a Physical Access Control System (PACS). 24 The status of a TWIC can also be confirmed by using a TWIC reader or PACS to check the Certificate Revocation List (CRL) for TWIC cards. The Department will also consider, in an SSP or ASP, any other specific innovative technologies that could allow high-risk chemical facilities to leverage the CCL or CRL for compliance with RBPS 12. 24 See footnote 8, supra. Other Comments Submitted in Response to the Information Collection Request Comment: Several commenters suggested the Department develop substantially different processes than the processes described by the Department in the CFATS IFR published in April 2007. One commenter suggested that the Department establish a process to certify vendors so that high-risk chemical facilities could rely on the certification as proof that the vendor has implemented security measures to ensure that its employees do not have terrorist ties. Several commenters suggested establishing a voluntary process by which the Department could collect information directly from affected individuals, and subsequently issue individuals unique submission numbers. The commenters suggested that an affected individual could then present the unique submission number to the high-risk chemical facility as evidence that the Department had conducted a security threat assessment to determine whether or not they had any terrorist ties. Response: Neither the notice published by the Department on March 22, 2013, nor this notice are rulemaking notices. These notices are published in accordance with the Paperwork Reduction Act and are not seeking to expand or change CFATS. Rather, these Paperwork Reduction Act notices are seeking comments on the burden associated with collecting information necessary to implement the CFATS Personnel Surety Program described in the CFATS IFR. Comment: One commenter suggested that the Department's “preconditions” (i.e., the collection of information under Option 2 to verify enrollment in the TWIC, HME, and Trusted Traveler Programs) “ipso facto do not provide reciprocal recognition of these vetting programs.” The commenter further suggested that the Department was not following White House recommendations to promote comparability and reciprocity across credentialing and screening programs. 25 Specifically, recommendation 16 of the Surface Transportation Security Priority Assessment, which recommends that the federal Government “create a more efficient Federal credentialing system by reducing credentialing redundancy, leveraging existing investments, and implementing the principle of `enroll once, use many' to reuse the information of individuals applying for multiple access privileges.” 25 Recommendation 16 of the Surface Transportation Security Priority Assessment may be found on page 21 of the 2010 White House report at http://www.whitehouse.gov/sites/default/files/rss_viewer/STSA.pdf. Response: The collection of information under Option 2 to verify enrollment of an affected individual in the TWIC, HME, and the Trusted Traveler Programs does recognize and leverage the vetting activities of the TWIC, HME, and Trusted Traveler Programs. Further, the CFATS Personnel Surety Program aligns with the recommendations of the Surface Transportation Security Priority Assessment. In discussions with high-risk chemical facilities over the past several years, the Department has attempted to correct the persistent misinterpretation held by commenters about the concept of “enroll once, use many” as meaning that an individual should only need to submit information to the Department once, and that the Department should never collect information from that individual again. Rather, the Department has defined, and continues to define, the “enroll once, use many” concept as the ability to reuse previously submitted program enrollment information and/or vetting results upon collection of sufficient information to confirm an individual's prior enrollment in a Department program or prior vetting results. One example of how the Department has implemented “enroll once, use many” in a DHS program other than the CFATS Personnel Surety Program is when a person whose is enrolled in the TWIC Program seeks to obtain an HME. TSA collects sufficient information from the person enrolled in the TWIC Program to verify the person's identity and verify the existence of a current and valid security threat assessment. 26 If verified, the existing STA is leveraged for the HME, which provides for efficiencies such as reduced enrollment cost and shorter processing time. 26 The online form may be found at https://hazprints.tsa.dhs.gov/Public/STAStatus.aspx Comment: Several commenters suggested that the collection of information under Option 2 to verify an affected individual's enrollment in the TWIC, HME, and the Trusted Traveler Programs qualifies as a duplicative background check. Response: The information collected by the Department under Option 2 is used to verify an affected individual's enrollment in a DHS program. The information collected under Option 2 is not used to conduct a duplicative background check. Comment: Another commenter suggested that the collection of information under Option 2 from affected individuals in possession of an HME as a proposal to “screen drivers carrying hazardous materials” violates 49 U.S.C. 5103a(g)(1)(B)(i) which states that “[a]n individual with respect to whom the Transportation Security Administration—(I) has performed a security threat assessment under this section; and (II) has issued a final notification of no security threat, is deemed to have met the requirements of any other background check that is required for purposes of any Federal law applicable to transportation workers if that background check is equivalent to, or less stringent than, the background check required [to receive an HME].” Response: Collecting information to verify an affected individual's enrollment, so that if verified the Department may rely on the results of the security threat assessment already performed and being recurrently performed, is not prohibited by 49 U.S.C. 5103a(g)(1)(B)(i), and comports with the means of vetting verification described in the CFATS IFR. Comment: One commenter suggested that the credentials be accepted “at face value.” The commenter further suggested that, “[t]he fact [that affected individuals] have a valid card meets the requirement specifically detailed in RBPS 1[2] and any further collection and submission of PII not only exceeds DHS' authority but results in duplication of effort and unnecessary cost to both the facilities and to DHS.” Another commenter suggested that possession of a credential was “proof” that the affected individual was vetted and is being revetted for terrorist ties. Another commenter took an opposing view, and supported Option 2. The commenter agreed with the Department's intention to collect information to electronically verify and re-verify affected individuals' enrollments in the TWIC, HME, and Trusted Traveler Programs. Response: While visual inspection has some security benefits, electronic verification is significantly more reliable than visual inspection for ensuring that a TWIC, HME, or Trusted Traveler Credential is not counterfeit or expired, or has not been reported lost, stolen, damaged, or revoked. Accordingly, if a high-risk chemical facility chooses to implement Option 2, the high-risk chemical facility (or its designees) must submit information to the Department about affected individuals possessing the appropriate credentials to enable the Department to electronically verify, with the relevant component of DHS (i.e., CBP or TSA) using their authoritative and original data, the affected individuals' enrollments in these other programs. Comment: Several commenters suggested that the Department was requiring all visitors to have their information submitted to the Department 48 hours in advance of entering the site, which does not comport with the operational realities of the trucking industry. Response: The Department disagrees that this ICR does not comport with the operational realities of the trucking industry. The Department disagrees for four reasons. First, if a high-risk chemical facility chooses to allow visitors (e.g., truck operators) access to the high-risk chemical facilities, for only those visitors with unescorted access to restricted areas or critical assets will the facility need to comply with RBPS 12. Second, the Department does not believe it likely that many high-risk chemical facilities will propose in their SSPs or ASPs to allow large numbers of visitors who visit the high-risk chemical facility infrequently to have unescorted access to restricted areas and critical assets, because then all four types of background checks listed in RBPS 12 would be required to be conducted for them. If the historical practice of a chemical facility has been to allow unescorted visitors access to the restricted areas or critical assets, without performing any background checks on them, the Department recognizes that the business practices of such a high-risk chemical facility will need to change as a result of RBPS 12(i), (ii), (iii), and (iv). Third, the Department generally expects that high-risk chemical facilities and designees will likely consolidate RBPS 12(iv) processing with related routine hiring and access control procedures already occurring prior to access by facility personnel or unescorted visitors to restricted areas or critical assets. As a result of discussions with industry stakeholders the Department understands that, in general, routine hiring and access control procedures are already in place for individuals, likely to be designated as affected individuals because of access to restricted areas or critical assets, working on behalf of trucking companies. Fourth, in the default schedule provided later in this notice, the Department suggests that information about a new affected individual could be provided to the Department no later than 48 hours prior to that affected individual obtaining access to the restricted areas or critical assets at a high-risk chemical facility. The Department would like to highlight that information about a particular affected individual does not need to be re-submitted to the Department 48 hours prior to each instance of access by that particular affected individual. Rather, if a high-risk chemical facility, or its designees, are able to determine that an affected individual requires repeated access to restricted areas or critical assets, the high-risk chemical facility may structure the data submission to CSAT so as to indicate that the affected individual about whom the high-risk chemical facility or designee is submitting information to the Department will have access to restricted areas or critical assets on an ongoing basis. A high-risk chemical facility, or its designees, may also structure the data submission to CSAT to indicate that the affected individual will have access to restricted areas or critical assets for a discreet period of time. Therefore, for the reasons provided above, the Department disagrees that this ICR does not comport with the operational realities of the trucking industry. Comment: Several commenters raised objections to submitting a new affected individual's information at least 48 hours prior to their access to restricted areas or critical assets at high-risk chemical facilities. Some commenters suggested that submission of a new affected individual's information should occur, rather, only at the time the new affected individual actually accesses restricted areas or critical assets. Alternatively, some commenters suggested that that submission of a new affected individual's information should occur after the affected individual accessed restricted areas or critical assets. Response: The Department, in the default schedule provided later in this notice, suggests that information about new affected individuals could be provided to the Department no later than 48 hours prior to the affected individual obtaining access to the restricted areas or critical assets at the high-risk chemical facility. The Department believes that 48 hours is a reasonable amount of time, which is necessary for the Department to successfully perform a background check for terrorist ties. Therefore the Department has suggested a period of time (i.e., 48 hours) as a default for when high-risk chemical facilities could submit information to the Department for new affected individuals rather than at the time, or after the time, a new affected individual obtains access to restricted areas or critical assets. Later in this notice, the Department also reiterates that it will consider alternative schedules suggested by high-risk chemical facilities in their SSPs or ASPs, for Option 1 or Option 2, based on their unique circumstances. Comment: Several commenters expressed concern about contractors and visitors arriving upon short or no notice such as when a production unit goes down or otherwise requires emergency maintenance. Response: The Department understands that contractors and visitors may arrive with only short or no notice such as when a production unit goes down or otherwise requires emergency maintenance. The Department described, in the illustrative examples provided earlier in this notice, how a high-risk chemical facility could comply with RBPS 12, ensuring that all four background checks are conducted in such situations. High-risk chemical facilities should describe in their SSP or ASP the procedures and process 27 to plan for and prepare for exceptional circumstances (e.g., unpredictable but foreseeable situations) that result in situations that require an affected individual to have short or no notice before accessing the restricted areas or critical assets at high-risk chemical facilities such as when a production unit goes down or otherwise requires emergency maintenance. 27 One example applied from the illustrative scenarios would be that the high-risk chemical facility would have in it contract clauses that require any contractors that provides emergency repair or maintenance to have background checks completed prior to arrival at the high-risk chemical facility, to include the submission of information about the affected individuals to the Department under Option 1 or Option 2. Comment: Several commenters pointed out to the Department that TSA recently modified the TWIC application form 28 to expand the population of individuals eligible to apply for a TWIC. The commenters uniformly suggested that the Department expand the population of individuals eligible to apply for a TWIC to include affected individuals that have or are seeking access to the restricted areas or critical assets of high-risk chemical facilities. 28 The revised TWIC application form may be viewed at ( http://www.reginfo.gov/public/do/PRAViewIC?ref_nbr=201210-1652-001&icID=182269 ). Response: Any determination the Department or TSA makes to expand or revise the population of individuals eligible to apply and pay for TWICs is outside the scope of this notice. Comment: Some commenters supported the Department's determination that certain groups are not affected individuals, specifically, (1) Federal officials that gain unescorted access to restricted areas or critical assets as part of their official duties; (2) state and local law enforcement officials that gain unescorted access to restricted areas or critical assets as part of their official duties; and (3) emergency responders at the state or local level that gain unescorted access to restricted areas or critical assets during emergency situations. One commenter did not support the determination and suggested that this determination only incentivized terrorists to assume the identities of law enforcement officials rather than workers. Response: The Department has opted to align how CFATS treats certain groups of persons with how those same populations are treated under the TWIC Program. 29 29 See 33 CFR 101.514 at ( http://www.ecfr.gov/cgi-bin/retrieveECFR?gp=1&SID=ef5225aac07eddf7f914e57c3fda36bf&ty=HTML&h=L&r=PART&n=33y1.0.1.8.49#33:1.0.1.8.49.5.26.4 ) Comment: One commenter objected to the inclusion of railroad employees as potentially affected individuals. Response: Railroad employees may be affected individuals if the high-risk chemical facility has defined railroad employees in their SSP or ASP as either (1) facility personnel who have access, either unescorted or otherwise, to restricted areas or critical assets, or (2) unescorted visitors who have access to restricted areas or critical assets. Each high risk chemical facility can choose which option or options it wishes to implement with regard to railroad employees that would be affected individuals. The Department notes that many railroad employees have TWICs and encourages high-risk chemical to consider whether Option 2 or Option 3 may provide a reasonable solution. Comment: One commenter suggested that the 60-day notice was unclear as to which set of individuals would be subject to vetting for terrorist ties. The commenter pointed out that the Department used the term “affected individuals” inconsistently. In parts of the 60-day notice, the Department described the term to mean “facility personnel or unescorted visitors with access to restricted areas or critical assets at high-risk chemical facilities.” In other parts of the 60-day notice the Department described the term to mean “(1) facility personnel who have access, either unescorted or otherwise, to restricted areas or critical assets, and (2) unescorted visitors who have access to restricted areas or critical assets.” Response: 6 CFR 27.230(a)(12) defines the scope of individuals for whom RBPS 12 (and thus RBPS 12(iv)) background checks are required. 6 CFR 27.230(a)(12) defines the scope as “facility personnel, and as appropriate, for unescorted visitors with access to restricted areas or critical assets” at high-risk chemical facilities. The Department has provided additional clarity in previous notices that affected individuals are (1) facility personnel who have access, either unescorted or otherwise, to restricted areas or critical assets, and (2) unescorted visitors who have access to restricted areas or critical assets. In response to public comments received on earlier notices, the Department clarified, and does so here in this notice, that individual high-risk facilities may classify particular contractors or categories of contractors either as “facility personnel” or as “visitors.” This determination should be a facility-specific determination, and should be based on facility security, operational requirements, and business practices. Comment: One commenter objected to the Department's intention to collect information that identifies the high-risk chemical facility or facilities at which each affected individual has or is seeking access. Response: The Department requires this information so that in the event of a positive match, the Department may provide the information to appropriate federal law enforcement entities. Comment: One commenter suggested that the ICR approach was deficient because the Department, based on public comments received, is unable to amend the text of 6 CFR part 27. The commenter suggested that without the benefit of a rule published in the Code of Federal Regulations, covered facilities will not know what identifying information is to be provided on individuals, and within what timeframes thus rendering the standards for personnel surety invisible. Response: The ICR and the associated 60-day and 30-day notices do not modify 6 CFR part 27. The ICR and associated notices provide descriptions of the nature of the CFATS Personnel Surety Program's information collection, categories of respondents, estimated burden, and costs. The Department is publishing this notice in accordance with the Paperwork Reduction Act because, although the Department has the authority to implement the CFATS Personnel Surety Program, the Department must still comply with the Paperwork Reduction Act and its implementing regulations before collecting the necessary information from high-risk chemical facilities or designees. Comment: One commenter suggested that the three options described in the 60-day notice are an impermissible mandate. The commenter states that RBPS 12 does not require that a facility continuously vet covered individuals against the TSDB. Response: In April 2007, the CFATS IFR outlined two options, described earlier in this notice, for high-risk chemical facilities to identify individuals with terrorist ties. Both options rely on recurrent vetting, which was one of the underlying bases for including those options in the CFATS IFR. Comment: Several commenters suggested that the CFATS Personnel Surety Program outlined in the ICR exceeds the Department's statutory authority, because the proposed CFATS Personnel Surety Program design conflicts with Section 550. Commenters suggested that the CFATS Personnel Surety Program's design eliminates a high-risk facility's flexibility to achieve compliance with RBPS-12. The commenters cited the following examples: (1) The “48-hour rule,” (2) “submission of PII on valid TWIC, DOT HAZMAT, or Trusted Traveler card holders,” and (3) “notification when personnel depart a regulated site[.]” Response: The CFATS Personnel Surety Program will not exceed the Department's statutory authority, nor will it violate or conflict with Section 550. With respect to the specific examples cited by commenters, the Department does not believe these examples demonstrate a violation of the statutory requirement that the Department not disapprove a Site Security Plan on the basis of the presence or absence of a particular security measure. Not only does the Department disagree that 48-hour advance submission violates Section 550, the Department also disagrees with the characterization of the default schedule as a “rule.” As discussed earlier in this notice, the Department is not seeking to implement a new regulation. Rather, this notice is published in accordance with the Paperwork Reduction Act. The Department disagrees that a default expectation that high-risk chemical facilities or designees submit information about new affected individuals at least 48 hours in advance of access eliminates a high-risk facility's flexibility to achieve compliance with RBPS-12. A high-risk chemical facility may suggest alternative schedules, for Option 1 or Option 2, based on their unique circumstances in their SSPs or ASPs. The Department also disagrees that the “submission of PII on valid TWIC, DOT HAZMAT, or Trusted Traveler card holders” violates Section 550. The CFATS Personnel Surety Program will not exceed the Department's statutory authority, nor will it violate or conflict with Section 550 because the Department will provide and approve sufficient alternative methods for a high-risk chemical facility to satisfy the terrorism ties background check portion of RBPS 12. A high-risk chemical facility does not have to select Option 2. Rather, if a high-risk chemical facility or its designees is unable or unwilling to submit information about affected individuals to verify their enrollment, a high-risk chemical facility may select Option 1, Option 3, or propose another alternative. The Department also notes the commenter's use of the term “valid.” Collection of information is necessary under Option 2 because it would be inappropriate to have confidence in the validity of a credential based solely on a visual inspection of the credential. Electronic verification of the affected individuals' enrollments in other programs provides significantly greater confidence that the credential in the possession of the affected individual is not counterfeit or expired, or has not been reported lost, stolen, damaged, or revoked. Finally, the Department disagrees that “notification when personnel depart a regulated site” violates Section 550. The CFATS Personnel Surety Program does not require “notification when personnel depart a regulated site.” Rather the Department requires notification when an affected individual whose information has been submitted under Option 1 or Option 2 no longer has access to restricted areas or critical assets. This distinction is important—the Department has not suggested that it expects high-risk chemical facilities to update the information it sends to DHS through CSAT in real time as individuals depart the workplace, nor has it suggested that notifications are required under Option 3 or under any other options high-risk chemical facilities might propose to DHS in their SSPs or ASPs. Notifications about individuals whose information has been submitted to DHS under Option 1 and Option 2, and who will subsequently lose access to restricted areas or critical assets, could occur before or after access is lost—high-risk facilities could propose schedules for this type of notification to DHS in their SSPs or ASPs, and DHS would evaluate these proposals on a case-by-case basis, taking into account unique facility operational and security needs. The primary distinction between “notification when personnel depart a regulated site” and the Department's requirement to be notified under Options 1 and 2 when an affected individual no longer has access is that the CFATS Personnel Surety Program is not tracking the real-time access of an affected individual at a high-risk chemical facility. Rather, the Department, under the CFATS Personnel Surety Program is seeking to ensure that affected individuals (whether they enter several times a day or only once over the time period in which they have the capability to enter) are checked for terrorist ties. This difference means that high-risk chemical facilities or their designees only need to notify the Department when to cease vetting once. This is in stark contrast to the multiple notifications that would be necessary if the Department required notification when “personnel depart a regulated site.” High-risk chemical facilities and their designees have at least two alternatives in how to notify the Department that an affected individual whose information has been submitted to DHS under Option 1 or Option 2 no longer has access. The first alternative is to submit the notification when the affected individual no longer has access. Under this alternative, a high risk chemical facility or designee would submit information about the affected individual initially and later in a separate communication notify the Department that the affected individual no longer has access. A second alternative the Department has provided is to allow the high-risk chemical facility or designee the ability to specify when the Department should stop vetting at the time of the initial submission. There are also additional alternatives available to high-risk chemical facilities. Under Option 3, the high risk chemical facilities may electronically verify and validate an affected individual's TWIC, through the use of TWIC readers (or other technology which is periodically updated with revoked card information), rather than submitting information about the affected individual to the Department. Consequently, there is no need for a high risk chemical facility to notify the Department when the affected individual no longer has access if the affected individual's TWIC is electronically verify and validated, through the use of TWIC readers (or other technology which is periodically updated with revoked card information). As previously discussed in this notice, high-risk chemical facilities are also able to propose other options for DHS consideration as part of their SSPs or ASPs. In conclusion, the only way the Department will know that an affected individual no longer has or is seeking access, under Option 1 or Option2, is if the facility (or their designee) notifies the Department when personnel no longer have (or no longer are seeking) access to a regulated facility's restricted areas or critical assets. The Department disagrees that this aspect of the CFATS Personnel Surety Program exceeds the Department's statutory authority, violates, or conflict with Section 550. Comment: Several commenters suggested that the Department, in particular NPPD, has in the design of the CFATS Personnel Surety Program refused to leverage credentials from comparable programs. The commenter implied that NPPD could consider how TSA opted to implement the “Air Cargo Screening Program”, and how ATF implemented the Employee Possessor Program. Response: Not all federal background checks conduct checks for terrorist ties that are equivalent to the background check for terrorist ties being conducted by the CFATS Personnel Surety Program. The Department has evaluated the ATF Employee Possessor Program and identified that the Employee Possessor Program conducts point-in-time vetting against the TSDB, which means that ATF's checks are conducted at only specified times, not on a recurrent basis. Recurrent vetting is a DHS best practice and compares an affected individual's information against new and/or updated TSDB records as new and/or updated records become available. The Indirect Air Carrier (IAC) and the Certified Cargo Screening Program (CCSP) programs both conduct terrorist ties vetting equivalent to the terrorist ties vetting that would be conducted under Option 1. After the initial implementation of the CFATS Personnel Surety Program, if (A) the Department learns through interactions with CFATS stakeholders that a reasonable percentage of affected individuals participate in the IAC and CCSP programs, and (B) there is substantial interest from members of the regulated community in leveraging the IAC and CCSP programs, then NPPD may consider allowing high-risk chemical facilities to submit the full name, date of birth, and appropriate program-specific information or credential information necessary to enable the Department to electronically verify the affected individuals' enrollments in IAC and CCSP programs. Comment: Several commenters suggested that the ICR claims to leverage the TWIC, HME, and the Trusted Traveler Programs, but facilities or their designees must submit more information under Option 2 than if the high-risk chemical facility or designee opted to submit the minimum information required under Option 1. The commenters conclude those who have already been screened face more burdens and greater scrutiny than those lacking any screening at all. Response: The Department has long conceded that the minimum number of data elements necessary to conduct vetting under Option 1 may, in some cases, be less than the minimum number of data elements to electronically verify an affected individual's enrollment in the TWIC, HME or Trusted Traveler Programs. This is because of how the TWIC, HME, and Trusted Traveler databases were initially constructed, not because affected individuals undergo extra scrutiny when the Department electronically verifies their enrollment Comment: One commenter requested clarification about the process of releasing employee information. Response: The scope of this notice is limited to the information submitted by a high-risk chemical facility (or designee) to the Department, which is subject to the Privacy Act of 1974 (5 U.S.C. 552a). The Department will only release or disclose this information in accordance with the applicable Privacy Act System of Records Notice. The Submitter(s) of each high-risk chemical facility (or their designee) will be required to affirm that, in accordance with their Site Security Plans, notice required by the Privacy Act of 1974 has been given to affected individuals before their information is submitted to DHS. DHS has made available to high-risk chemical facilities a sample notice that complies with subsection (e)(3) of the Privacy Act (5 U.S.C. 552a(e)(3)) in the CFATS Personnel Surety Program PIA. 30 This notice would: (1) Notify those individuals that their information is being submitted to DHS for vetting against the Terrorist Screening Database, and that in some cases additional information may be requested and submitted in order to resolve a potential match; (2) instruct those individuals how to access their information; (3) instruct those individuals how to correct their information; and (4) instruct those individuals on procedures available to them for redress if they believe their information has been improperly matched by the Department of Homeland Security to information contained in the Terrorist Screening Database. Individuals have the opportunity and/or right to decline to provide information, however, if an individual declines to provide information, he or she may impact a high-risk chemical facility's compliance with CFATS. 30 Available at http://www.dhs.gov/xlibrary/assets/privacy/privacy-pia-nppd-cfats-ps.pdf . In addition, high-risk chemical facilities (or designees) may have information about an affected individual obtained for other purposes (e.g., compliance with RBPS 12(i)-(iii)) that was never submitted to the Department and thus not subject to the Privacy Act. While under CFATS no specific controls are required for information collected by high-risk chemical facilities with regard to RBPS 12(i)-(iii), the Department expects that high-risk chemical facilities will protect and safeguard the information as outlined in their SSP and in accordance with any other federal, State, or local privacy laws which do have jurisdiction relative to the collection of the information. Comment: One commenter expressed concern about the Department's request for an exception to the PRA notice requirement in 5 CFR 1320.8(b)(3) when the Department is also requiring that Submitters must affirm that the required privacy notice regarding the collection of personal information has been provided to affected individuals before personal information is submitted to the Department. Specifically, the commenter suggested that “in order to make such an affirmation in good faith, the facility would almost certainly need to obtain signatures or other positive affirmations from affected individuals to protect itself against any claims of non-compliance.” Response: The Department believes that it is possible for a high-risk chemical facility or designee to affirm, in good faith, that the affected individual has been given adequate notice pursuant to the Privacy Act without collecting a signature from each and every affected individual. For example, a high-risk chemical facility or its designees could consider including an appropriate statement in pay checks, posting a sign near a restricted area or critical asset, including an appropriate statement within existing standard privacy notices provided to individuals when collecting information during a routine and normal hiring process, or including an appropriate statement in a letter. Comment: One commenter requested clarification about what the Department will do with the information it collects. The commenter further suggested that reducing the security risk associated with personnel RBPS 12 could be in conflict with selecting the “best qualified personnel/contractor” to work in the restricted area or critical asset. Response: The Department will, under this ICR, collect the information necessary to implement the CFATS Personnel Surety Program. The CFATS Personnel Surety Program will use the information to identify affected individuals with terrorist ties. With respect to the potential conflict between reducing security risk and selecting the best qualified personnel/contractor, the Department stated in the CFATS IFR, “that the level of screening for employees and contractors should be commensurate with the access provided. As part of this approach, the facility shall identify critical assets and restricted areas and establish which employees and contractors may need unescorted access to those areas or assets, and thus must undergo a background check . . .”. 31 A facility's approach to personnel surety, including its defined restricted areas and critical assets, shall be detailed in the Site Security Plan that the facility submits to the Department for approval. 31 See 72 FR 17688 (April 9, 2007) at https://www.federalregister.gov/articles/2007/04/09/E7-6363/chemical-facility-anti-terrorism-standards#p-302 . Comment: Some commenters suggested that without a commitment from the Department to be notified when an affected individual has terrorist ties, there was little value to the default schedule which has high-risk chemical facilities submitting information about new affected individuals 48 hours prior to access to restricted areas or critical assets. Response: The CFATS Personnel Surety Program, when implemented, will identify affected individuals with terrorist ties. The Department has procedures in place that it will follow to resolve the match and coordinate with appropriate law enforcement entities as necessary. The Department believes that 48 hours is a reasonable amount of time for the Department to successfully perform a background check for terrorist ties, and to coordinate with appropriate law enforcement entities as necessary. Comment: Several commenters suggested that by not committing to notify high-risk chemical facilities or designees when an affected individual has terrorist ties, the Department is increasing the risk of an affected individual with terrorist ties obtaining access to the restricted areas or critical assets at a high-risk chemical facility. Response: The Department's design of the CFATS Program is intended to promote and enhance the security of high-risk chemical facilities; the Personnel Surety Program is one element of the larger CFATS Program. To prevent a significant threat to a facility or loss of life, a high-risk chemical facility will be contacted where appropriate and in accordance with federal law and policy, as well as law enforcement and intelligence requirements. Comment: One commenter suggested that the design of the CFATS Personnel Surety Program appears to indicate the Department is playing an investigative role rather than a preventative role. Response: The CFATS Personnel Surety Program is designed to identify affected individuals with terrorist ties who have or are seeking access to restricted areas or critical assets at high-risk chemical facilities. The Department does not lead the investigation of any affected individual with terrorist ties; rather the Department supports law enforcement investigation activity. The Department recognizes the significant and vested interest the high-risk chemical facility or designee may have in ensuring an affected individual with terrorist ties does not successfully carry out a terrorist attack against or involving a high-risk chemical facility. Comment: One commenter requested that the Department define what a high-risk chemical facility is. Response: Public Law 109-295 required the Department to identify and regulate the security of high-risk chemical facilities. The CFATS regulations implement this statute and describe how DHS determines which chemical facilities are high-risk chemical facilities. Defining high-risk chemical facilities is beyond the scope of this notice and is beyond the scope of the ICR for the CFATS Personnel Surety Program. Comment: Several commenters pointed out that under Option 1, the Department will not be providing the results (i.e., that the affected individual does or does not have terrorist ties) to the high-risk chemical facility or designee, while under Option 2, the Department will be providing the results (i.e., that the Department was able to electronically verify that the affected individual is currently enrolled in either the TWIC, HME, or Trusted Traveler Programs). Some commenters suggested that not providing results under Option 1 but providing results under Option 2 was confusing. Some commenters suggested that by providing results under Option 2, high-risk chemical facilities will have greater confidence that the affected individual does not have terrorist ties (and the credential is not expired, has not been revoked, and is not fraudulent). The commenters pointed out that high-risk chemical facilities would also have greater confidence than when only relying on the visual inspection of the TWIC or other federal credential. Response: The Department has designed the CFATS Personnel Surety Program to support high-risk chemical facilities' compliance with RBPS 12(iv) through a variety of options. The Department does agree that the flexibility high-risk chemical facilities and designees have does increase the complexity of the CFATS Personnel Surety Program, however, this flexibility increases the ability of each high-risk chemical facility to be able to tailor their SSP or ASP to their unique business operations when considering how to comply with RBPS 12(iv). The Department also believes that this flexibility provides ancillary benefits. Specifically, a high-risk chemical facility may choose to rely on the electronic verification and re-verifications provided by the Department under Option 2 to demonstrate compliance with RBPS 12(i)-(iii). A high-risk chemical facility may choose to rely on the Department's electronic verification and re-verification (provided via CSAT) under Option 2 not only for RBPS 12(iv) but also RBPS 12(i)-(iii) because an affected individual's enrollment in the TWIC, HME, and Trusted Traveler Programs is dependent not only on an equivalent check for terrorist ties, but on several other factors such as a verification of identity, legal authorization to work, and a criminal history check. Therefore, a high-risk chemical facility may, in their SSP or ASP, choose to rely on the Department's electronic verification and re-verification that an affected individual is currently enrolled in the TWIC, HME, and Trusted Traveler Programs as a means of complying with RBPS 12(i)-(iii). High-risk chemical facilities should carefully consider whether the specific elements of the security threat assessments performed under the TWIC, HME, or Trusted Traveler Programs meet their business and security needs before choosing to rely on them for compliance with RBPS 12(i)-(iii) in their SSP or ASP. The Department would like to highlight that, under Option 2, high-risk chemical facilities or designees will be able to, for the first time, electronically verify an affected individual's enrollment in either the HME Program or Trusted Traveler Programs. Consequently, a high-risk chemical facility or designee may choose to rely on the Department verification of enrollment, Under Option 2, to comply with RBPS 12(iv) and RBPS 12(i)-(iii). Comment: Several commenters suggested that providing information about an affected individual to the Department prior to access would complicate the ability of a high-risk chemical facility or designee to substitute contract workers, service providers, third party carriers, and the like on short notice in the event of an accident, illness or change in work assignment/scope. Response: Earlier in this notice the Department outlined its understanding about how high-risk chemical facilities and designees could include steps for RBPS 12(iv) in their normal business operations when conducting the routine and normal background checks required for RBPS 12(i)-(iii). The steps a high-risk chemical facility normally takes to comply with RBPS 12(i)-(iii) when faced with substitute contract workers, service providers, third party carriers, and the like on short notice in the event of an accident, illness or change in work assignment/scope should be a part of a high-risk chemical facility's SSP or ASP. These steps, or specific alternative steps to comply with RBPS 12(iv) could also be a part of, or incorporated wit [Text truncated at 120,000 characters. The full text is on the page linked above.] --- Source: Frix Law Library, https://www.frixlaw.com/law-library/documents/fr%3A2014-02082. Public record. Not legal advice.