CFATS Personnel Surety Statement A for PRA (04-20-11)

Supporting Statement for PRA Submission

Chemical Facility Anti-Terrorism Standard Personnel Surety Program

OMB Control Number 1670-NEW

A. Supporting Statement A for the Chemical Facility Anti-Terrorism Standards (CFATS) Personnel Surety Program

1. Circumstances Making the Collection of Information Necessary

On October 4, 2006, the President signed the DHS Appropriations Act of 2007 (the Act), Public Law 109-295. Section 550 of the Act (Section 550) provides DHS with the authority to regulate the security of high-risk chemical facilities. DHS has promulgated regulations implementing Section 550, the Chemical Facility Anti-Terrorism Standards, 6 CFR Part 27.

Section 550 requires that DHS establish Risk Based Performance Standards (RBPS) as part of CFATS. RBPS-12 (6 CFR 27.230(a)(12)(iv)) requires that regulated chemical facilities implement “measures designed to identify people with terrorist ties.” The ability to identify individuals with terrorist ties is an inherently governmental function and requires the use of information held in government-maintained databases, which are unavailable to high-risk chemical facilities. Therefore, DHS is implementing the CFATS Personnel Surety Program, which will allow chemical facilities to comply with RBPS-12 by implementing “measures designed to identify people with terrorist ties.”

This collection aligns with 1670-0007 (CSAT), 1670-0015 (CVI) and 1670-0014 (CFATS) to collect information under CFATS. This collection enables the Department to collect information to conduct a background check for terrorist ties of affected individuals at high-risk chemical facilities. 1670-0007 (CSAT) is a collection which is primarily responsible for the collection of information electronically through the Chemical Security Assessment Tool (CSAT) from high-risk chemical facilities. 1670-0015 (CVI) collects information related to the unique information protection regime which ensures the information provided by high-risk chemical facilities to the federal Government is properly protected. 1670-0014 (CFATS) collects information that supports the Department’s management of CFATS communications and notifications from the high-risk chemical facilities.

2. By whom, how, and for what purpose the information is to be used

The CFATS Personnel Surety Program will work with the DHS Transportation Security Administration (TSA) to identify individuals who have terrorist ties by vetting information submitted by each high-risk chemical facility against the TSDB.

High-risk chemical facilities or their designees will submit the information of: 1) facility personnel who have or are seeking access, either unescorted or otherwise, to restricted areas or critical assets; and 2) unescorted visitors who have or are seeking access to restricted areas or critical assets. These persons, about whom high-risk chemical facilities and facilities’ designees will submit information to DHS, are referred to as “affected individuals.”¹

Information will be submitted to NPPD through the Chemical Security Assessment Tool (CSAT), the online data collection portal for CFATS. The high-risk chemical facility or its designees will submit the information of affected individuals to DHS through CSAT. The submitters of this information (“Submitters”) for each high-risk chemical facility will also affirm, to the best of their knowledge, that the information is: 1) true, correct, and complete; and 2) collected and submitted in compliance with the facility’s Site Security Plan (SSP) or Alternative Security Program (ASP), as reviewed and authorized and/or approved in accordance with 6 CFR 27.245. The Submitter(s) of each high-risk chemical facility will also affirm that, in accordance with their Site Security Plans, notice required by the Privacy Act of 1974, 5 U.S.C. § 552a, has been given to affected individuals before their information is submitted to DHS.

DHS will send a verification of receipt (previously referred to as a “verification of submission” in the 60-day and 30-day notices) to the submitter(s) of each high-risk chemical facility when a high-risk chemical facility: 1) submits information about an affected individual for the first time; 2) submits additional, updated, or corrected information about an affected individual; and/or 3) notifies DHS that an affected individual no longer has or is seeking access to that facility’s restricted areas or critical assets.

Upon receipt of each affected individual’s information in CSAT, NPPD will send a copy of the information to TSA. Within TSA, the Office of Transportation Threat Assessment and Credentialing (TTAC) conducts vetting against the TSDB for several DHS programs. TTAC will compare the information of affected individuals collected by DHS (via CSAT) to information in the TSDB. TTAC will forward potential matches to the TSC, which will make a final determination of whether an individual’s information is identified as a match to a record in the TSDB.

In the event that an affected individual’s information is confirmed to match a record in the TSDB (which DHS refers to as a “match to the TSDB,” or simply as a “match”), the TSC will notify NPPD and the appropriate federal law enforcement agency for coordination, investigative action, and/or response, as appropriate. NPPD will not routinely provide vetting results to high-risk chemical facilities nor will it provide results to an affected individual whose information has been submitted by a high-risk chemical facility. As warranted, high-risk chemical facilities may be contacted by DHS or federal law enforcement agencies as part of law enforcement investigation activity.

CFATS does not require Part B to this PRA Justification to demonstrate consistency with the proposed statistical methods.

3. Use of Improved Information Technology and Burden Reduction

This collection primarily uses the CSAT to reduce the burden on chemical facilities by streamlining the data collection process to meet CFATS regulatory obligations. Collecting the required information primarily through CSAT enhances access controls and reduces the paperwork burden of the high-risk chemical facilities.

4. Efforts to Identify Duplication and Use of Similar Information

Other DHS Vetting Programs

Some affected individuals may have been previously vetted by other DHS vetting programs (e.g. Transportation Worker identification Credential) against the consolidated and integrated terrorist watch list in the TSDB. To reduce duplication the Department will allow high-risk chemical facilities to leverage the previous equivalent TSDB background check and thus limit the number of instances in which different DHS programs may vet the same affected individual against the TSDB.

5. Impact on Small Business or Other Small Entities

No unique methods will be used to minimize the burden to small businesses.

6. Consequences of Collecting the Information Less Frequently

Reducing the frequency of the collection will increase the chances that individuals with terrorist ties will successfully attack high-risk chemical facilities.

7. Special Circumstances Relating to the Guidelines under 5 CFR § 1320.5(d)(2)(ii)

Requiring respondents to report information to the agency more often than quarterly

Respondents under this collection are the individuals whose information has been submitted by the high-risk chemical facility at which they have or are seeking access to restricted areas or critical assets. The reporting frequency for the high-risk chemical facility is directly related to the access controls and personnel turnover at the high-risk chemical facility.

8. Comments in Response to the Federal Register Notice and Efforts to Consult Outside the Agency

A 60-day public notice for comments was published in the Federal Register on June 10, 2009, at 74 FR 27555. Comments were received and responses were included in the 30-day notice.

A 30-day public notice for comments was published in the Federal Register on April 13, 2010, at 75 FR 18850. Comments were received and responses were published in a separate Federal Register notice.

9. Explanation of Any Payment or Gift to Respondents

There is no offer of monetary or material value for this information collection.

10. Assurance of Confidentiality Provided to Respondents

The confidentiality of information provided by respondents is covered through several mechanisms.

1. Chemical-terrorism Vulnerability Information (CVI) is a Sensitive But Unclassified designation authorized under P.L. 109-295 and implemented in 6 CFR 27.400.

2. P.L. 109-295 further clarifies that CVI, “in any proceeding to enforce this section, vulnerability assessments, site security plans, and other information submitted to or obtained by the Secretary under this section, and related vulnerability or security information, shall be treated as if the information were classified material.”

3. The Department is in the process of publishing a System of Records Notice which covers this collection.

DHS’s primary IT design requirement was ensuring data security. DHS acknowledges that there is a non-zero risk, both to the original transmission and the receiving transmission, when requesting data over the Internet. DHS has weighed the risk to the data collection approach against the risk to collecting the data through paper submissions and concluded that the web-based approach was the best approach given the risk and benefits.

DHS has taken a number of steps to protect both the data that will be collected through the CSAT program and the process of collection. The security of the data has been the number one priority of the system design. The site that the Department will use to collect submissions is equipped with hardware encryption that requires Transport Layer Security (TLS), as mandated by the latest Federal Information Processing Standard (FIPS). The encryption devices have full Common Criteria Evaluation and Validation Scheme (CCEVS) certifications. CCEVS is the implementation of the partnership between the National Security Agency and the National Institute of Standards (NIST) to certify security hardware and software.

11. Justification for Sensitive Questions

There are no standard questions of a sensitive nature. However, the Department may ask questions of a sensitive nature to confirm that the individual is or is not a match to a known or suspected terrorist in the TSDB.

12. Estimates of Annualized Burden Hours and Costs

Respondents under this collection are the individuals whose information has been submitted by the high-risk chemical facility at which they have access to restricted areas or critical assets. The CFATS Personnel Surety Program estimates that the high-risk chemical facility representative will spend about 0.54 hours per respondent and that there will be 1,303,700 respondents annually.

Therefore, the CFATS Personnel Surety Program estimates the annual burden to be 707,200 hours and the total annual respondent cost to be $ 29,704,000.

Table 1: Estimated Annualized Burden Hours and Costs

Type of Respondent	Form #	No. of Respondents	No. of Responses per Respondent	Avg. Burden per Response (in hours)	Total Annual Burden (in hours)	Avg. Hourly Wage Rate	Total Annual Respondent Cost
Individuals With Access to restricted areas or critical assets		1,303,700	1	0.54 (32.4 Minutes)	707,200	$42	$29,704,000
Total		1,303,700	1	0.54	707,200	$42	$29,704,000

13. Estimates of Other Total Annual Cost Burden to Respondents and Record Keepers

There are no other annual costs to respondents or high-risk chemical facilities for this information collection. It is assumed that all high-risk chemical facilities submitting information to the CFATS Personnel Surety Program will already have the appropriate computer hardware and internet connection.

14. Annualized Cost to the Federal Government

Federal government costs can be divided between the costs associated with collection of information from high-risk chemical facilities, and the costs associated with screening the information against the consolidated and integrated terrorist watch list in the TSDB. The former will be incurred primarily by ISCD and the latter by TSA.

Collection of Information by CFATS Personnel Surety Program

The costs associated with collecting the information from high-risk chemical facilities are the costs of operating and maintaining the Personnel Surety application within CSAT and the costs to manage and coordinate the CFATS Personnel Surety Program. The annual Operating and Maintenance (O&M) costs are estimated at $1.2M and the management and coordination cost is equivalent to the fully loaded cost of employing three government employees at the GS-14 level.

Table 2: Estimates of Annualized Costs for the Collection of Data

Expense Type	Expense Explanation	Annual Costs (dollars)
Direct Costs to the Federal Government	DHS Project Manager (GS-14, 3 FTE)	$497,700
CSAT O&M	Costs for O&M of CSAT Personnel Surety Application	$1,200,000
Total		$1,697,700

Vetting Costs

Costs to vet information against the consolidated and integrated terrorist watch list in the TSDB are composed of relatively stable annual O&M and a variable per person cost.

Table 3: Estimates of Annualized Costs for the Vetting

Expense Type	Expense Explanation	Annual Costs (dollars)
TSA O&M	Average annual cost during period of collection	$1,750,000
Variable person costs	$4.97 per person cost for 1,303,700 people	$6,479,400
Total		$8,229,400

Therefore, the annual cost is $8,229,400.

Initial Capital Costs

Initial capital costs for the CSAT Personnel Surety program are composed of the capital costs IP and TSA incurred. Those are:

Table 4: Estimates of Initial Capital Costs

Expense Type	Expense Explanation	Annual Costs (dollars)
IP	Initial technology capabilities	$1,200,000
TSA	Initial technology capabilities	$880,000
Total		$2,080,000

Total Federal Government Costs

In sum, the estimated total annual operating cost to the United States Government for collecting and conducting screening of information under the CFATS Personnel Surety Program is $8,229,400, in addition to an estimated initial capital cost of $2,080,000.

15. Explanation for Program Changes or Adjustments

The CFATS Personnel Surety Program is a new collection.

16. Plans for Tabulation and Publication and Project Time Schedule

No plans exist for the publication of data collected under this information collection for statistical use, tabulation, or statistical analysis.

17. Reason(s) Display of OMB Expiration Date is Inappropriate

The CFATS Personnel Surety Program will display the expiration date for OMB approval of this information collection.

18. Exceptions to Certification for Paperwork Reduction Act Submissions

The Department is requesting from OMB an exception for the CFATS Personnel Surety Program to the Paperwork Reduction Act (PRA) requirement, as contained in 5 CFR 1320.8(b)(3), which requires Federal agencies to confirm that their information collections provide certain reasonable notices, under the PRA, to affected individuals. If this exception is granted, DHS will be relieved of the potential obligation to require high-risk chemical facilities to collect signatures or other positive affirmations of these notices from affected individuals. Whether or not this exception is granted, DHS will still require high-risk facilities to affirm that required Privacy Act notice has been provided to affected individuals before personal information is collected.

The Department’s request for an exception to the requirement under 5 CFR 1320.8(b)(3) would not exempt high-risk chemical facilities from having to adhere to applicable Federal, State, local, or tribal laws, or to regulations or policies pertaining to the privacy of facility personnel and the privacy of unescorted visitors.

1 Individual high-risk facilities may classify particular contractors or categories of contractors either as “facility personnel” or as “visitors.” This determination should be a facility-specific determination, and should be based on facility security, operational requirements, and business practices.

Page 8 of 8