Document 655xy8zJ8o2B3753BJ7ez4kL9

Hogan Lovells Memorandum Hogan Lovells US LLP Columbia Square 555 Thirteenth Street, NW Washington, DC 20004 T +1 202 637 5600 F +1 202 637 5910 www.hoganlovells.com To From Date Richard Moskowitz Geoff Moody Lara Swett Taylor Hoverman Justin Savage Erin Ward Allison Bender January 10, 2017 Organization AFPM Subject Security Concerns With EPA's Final Risk Management Regulation This memorandum outlines the increased risks of terrorist activity or criminal interference at RMP covered facilities 1 as a result of EPA's final rule amending its Risk Management Program ("RMP"). I. Security Risks from Facilities with Hazardous Substances While EPA's Risk Management Program ("RMP") focuses primarily on preventing accidental releases of hazardous chemicals from stationary facilities , the opportunity for intentional release of these chemicals by criminals or terrorist organizations has been widely acknowledged. In fact, the Bureau of Alcohol Tobacco, Firearms and Explosives has determined that the 2013 West, Texas, incident, which led to EPA's promulgation of this final rule, was a criminal act.2 A 2014 study on the vulnerability of U.S. chemical facilities to terrorist attacks found that "the technical and organizational requirements to use a chemical facility as a weapon ... are well within the reach of the majority of terrorist groups.'3 As Scott Pruitt, the President-Elect's nominee to head the EPA,and other Attorneys General emphasized in their comments on EP A's proposed rule, "safety encompasses more than preventing accidental releases of chemicals, it also encompasses preventing intentional releases caused by bad actors seeking to harm our citizens.'4 1 This memorandum uses the terms "facilities" and "owners and operators" interchangeably. 2 West, Texas, Explosion Was a`Criminal Act' , The Atlantic (May 11, 2016), http://www.theatlantic.com/national/archive/2016/05/west-texas-explosion/482343/. 3 Gary Ackerman, Markus Binder, and Robert Denaburg, START: National Consortium for the Study of Terrorism and Responses to Terrorism, Are U.S. Chemical Facilities Still Open to Terrorist Attacks?, (Aug. 28, 2014), available at http://www.start.umd.edu/news/are-us-chemical-facilities-still-open-terrorist-attacks. 4 Letter from Scott Pruitt, Oklahoma Attorney General, et al. to Gina McCarthy, Administrator, U.S. Environmental Protection Agency, Re: Docket EPA -HQ-OEM-2015-0725-0001; Accidental Release 17cv1906 Sierra Club v. EPA - 6/22 Production ED 001523 00008486-00001 Richard Moskowitz -2- Taylor Hoverman January 10, 2017 Of particular concern is the public availability of sensitive information about the names and quantities of a facility's hazardous substances and any security vulnerabilities associated with them. For example, the House Committee on Energy and Commerce stated that publicly posting RMP information combined with "the growth of several internet-search engine-based mapping tools" could "constitute a virtual terrorist roadmap into a chemical facility, triggering devastating consequences."5 "Common sense dictates that this information must be restricted from Internet access and maintained under the current administrative access controls." 6 Congress has enacted m ultiple statutes specifically aimed at protecting information perceived to be vulnerable to exploitation by terrorist organizations: the 1999 Chemical Safety Information, Site Security and Fuels Regulatory Relief Act ("CSISSFRRA"); the Critical Infrastructure Information Act ("CIIA") i n connection with the Homeland Security Act of 2002; the Chemical Facilities AntiTerrorism Standards Act of 2007 ("CFATS Act"); and the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014 ("CFATS Act of 2014"), reauthorizing the CFATS program. Multiple commenterson EPA's proposed rule--including General Pruitt--expressed concerns that EPA's proposed information disclosure requirementswere promoting transparency at the expense of increasing security risks. General Pruitt and othe r Attorneys General emphasized that "as the federal agencies responsible for national security have warned you, compiling [information about RMP facilities] and making it easily accessible [] aids those who might seek to cause an intentional release for nefarious purposes, providing those bad actors with information that would help them both select a target and exploit any security vulnerabilities their target might have.'7 While EPA did not retain all of its proposed regulations in the final rule , those that remain create the potential for bad actors to access and exploit vulnerabilities of facilities with extremely hazardous chemicals. If allowed to go into effect, these regulations could jeopardize these facilities, the communities that surround them, and the American public. II. Arguments 1. Disclosures to Local Emergency Planning Committees ("LEPCs") a. All the same information EPA proposed to require facilities to release to LEPCs under the proposed rule could still be requested by LEPCs under the final rule The proposed rule identified specific information that facilities would have to make available to LEPCs upon request. Specifically, facilities would have to provide information on regulated substances, including names and the quantities held at the facility; accident history information; compliance audit reports; incident investigation reports; inherently safer technologies ("1ST"); and Prevention Requirements: Risk Management Programs Under the Cl ean Air Act, Section 112(r)(7); Proposed Rule (RIN 2050-AG82) (July 27, 2016) [hereinafter "AG Letter"]. 5 Letter from Fred Upton, Chairman, Committee on Energy and Commerce, U.S. House of Representatives, and John Shimkus, Chairman, Subcommittee on Environment and the Economy, U.S. House of Representatives, to Lisa P. Jackson, Administrator, U.S. Environmental Protection Agency (Feb. 10, 2012), available at http://archives.republicans.energycommerce.house.gov/Media/file/Letters/112th/021012EPA.pdf. 6 Id. 7 AG Letter. WDC - 029016/000012 - 9439448 vl 17cv1906 Sierra Club v. EPA - 6/22 Production ED 001523 00008486-00002 Richard Moskowitz -3- Taylor Hoverman January 10, 2017 facility emergency response exercises, including a schedule of upcoming exercises and reports for completed ones.8 Accident histories, compliance audits, incident investigations, 1ST analyses, and emergency exercise reports will generally contain information about the facility's security vulnerabilities. While some vulnerabilities might be resolved in the wake of an incident investigation or compliance audit, others may be inherent to the facility and the storage and processing of extremely hazardous chemicals. Others may not be immediately remediable. This information provides exactly the type of road map to ter rorists about which the House Committee was concerned. Similarly, information about 1ST is likely to identify facility conditions that terrorists may be able to exploit While the final rule drops the proposed rule's specific list of information to be disclosed upon request, EPA replaced it with a new provision that "requires the owner or operator to provideaby other information that local emergency planning and response organizations identify as relevant to local emergency planning.'"9 Though EPA claims that this provision would allow "assertions of Chemicalterrorism Vulnerability Information (CVI) status for certain information [to] be addressed on a casebycase basis,"10 EPA did not include any limitations in its final provision that would allow a n owner or operator to refuse to provide requested information on that basis. As a result, any of the types of information listed in the proposed rule that the LEPC can assert as "relevant to local emergency planning" can still be requested and must be provided by the facility. b. EPA failed to include any measures to protect information released, upon request, to local emergency planning committees ("LEPCs"). Any information released to LEPCs could be subsequently distributed to other individuals. Facilities typically conduct background checks on employees and implement security measures to protect their sensitive information. Furthermore, facilities have strong incentives to protect sensitive information from individuals that might seek to harm the facility's employees or property. By comparison, anyone can become a member of an LEPC , and background checks generally are not required. Nothing would prevent a bad actor from joiningan LEPC and gaining access to the types of sensitive information that EPA requires facilities to provide to LEPCs. Once obtained, such actors would have no legal restrictions on the use or distribution of that information. While EPA states in the final rule that LEPCs and facilities can "identify information that may need to be maintained securely and discuss strategies to secure the information," 11 such protections would be secured only by any agreement reached between the LEPC and the facility. EPA, DHS, and other agencies charged to protect the public would be unable to enforce any agreed upon protective measures or prosecute violators. 8 EPA, Proposed Rule, Accidental Release Prevention Requirements: Risk Management Programs Under the Clean Air Act, 81. Fed. Reg. 13,638,13,679-13,680 (Mar. 14, 2016) [hereinafter "Proposed Rule"]; see also EPA, Final Rule, Accidental Release Prevention Requirements: Risk Management Programs under the Clean Air Act 235 (Dec. 21, 2016), available at https://www.epa.gov/sites/production/files/2016- 12/documents/rmp final rule dec 20 2016 unsigned version for web with headf' 1 t 1" < 11 (unpublished as of Jan. 10, 2017) [hereinafter "Final Rule"]. 9 Final Rule at 240 (emphasis added). 10 Id. 11 Final Rule at 241. WDC - 029016/000012 - 9439448 vl 17cv1906 Sierra Club v. EPA - 6/22 Production ED 001523 00008486-00003 Richard Moskowitz -4- Taylor Hoverman January 10, 2017 EPA's revisions from the proposed rule only increased the flexibility available to LEPCs for selecting the type of informati on they want to request. It failed to address commenters' security concerns about providing such sensitive information to LEPCs in the first place, particularly without adequate protective measures and enforcement mechanisms in place. 2. Disclosures to the Public As with EPA's disclosure requirements to LEPCsfPA's final rule fails to addresscommenters' security concerns about required disclosures to the public. EPA's final rule requires an owner or operator to make available to the public upon request: the names of regulated substances that the facility had in quantities above the required threshold; safety data sheets for all such substances; the facility's accident history; information about the facility's emergency response provisions, such as whether it is a respondingstationary source, the name and phone number ofLEPCs, and, as relevant, procedures for informing the public and LEPCs about accidental releases; schedules of upcoming emergency response exercises; and LEPC contact information.12 EPA requires facilities to make known that such information is available to any member of the public upon requestand howto request it13 Within 45 days of such a request, the facilitym/sf provide the requested information.14 1E5PA did not include any exceptions that would permit a facility to refuse to disclose information on the grounds of security concerns about the information requested or the requesting individual. While the names of regulated substances held at the facility and safety data sheets must currently be disclosed to LEPCs under the Emergency Planning and Community Right -to-Know Act ("EPCRA"), they were not previously required to be disclosed to the public, and facilities could elect to withhold information about the location of the chemical at the facility from the public. The type, quantity, and location of hazardous chemicals at the facility could be dangerous in the hands of the wrong person. Furthermore, the accident history and emergency response exer cise reports could reveal the facility's vulnerabilities. In addition, recent intelligence reports indicate that terrorist groups intend to specifically target law enforcement agents and emergency responders to delay response activities and maximize the effects of attack. This information cautions against providing names and phone numbers for LEPCs. During the interagency review process, multiple government officials identified security concerns with EPA's proposed public disclosures. One identified "national security concerns" with sharing chemical names and quantities, safety data sheets, first responder point of contact informatipn and reports after emergency exercises with the public because it "could assist terrorists in selecting targets and/or increasing the severity of an attack by decreasing first responder capability.16 Another stated that sharing this information with the public "would be precedent setting- currently the CFATS, PSM, and ATF (liscensee [sic] /permittee) programs do not sh are this level of detail with the public 12 Proposed Rule at 13,681. 13 Final Rule at 251. 14 Final Rule at 252. 15 EPA, Interagency Communications Regarding EO 12866 Interagency Review of Risk Management Modernization, RIN 2050-AG8, Notice ofProposed Rulemaking Comments (redline) and Regulatory Impact Analysis Comments (redline), at 145b, EPA Docket No. EPA-HQ-OEM-2015-0725-0004. WDC - 029016/000012 - 9439448 vl 17cv1906 Sierra Club v. EPA - 6/22 Production ED 001523 00008486-00004 Richard Moskowitz -5- Taylor Hoverman January 10, 2017 due to security concerns. The EPA's proposed level of detail may inadvertently provide a roadmap to assist terrorists."16 In response to these comments, EPA removed the required disclosure of chemical quantities but otherwise kept theinformation disclosure requirements as proposed. EPA thus ignored the legitimate security concerns of intelligence and national security professionals. Finally, as with disclosures to LEPCs, EPA failed to include any measures to protect sensitive information from further disclosure or inappropriate uses once itis released to the public.16 16 Id. WDC - 029016/000012 - 9439448 vl 17cv1906 Sierra Club v. EPA - 6/22 Production ED 001523 00008486-00005