How times have changed for hazardous materials shippers. Only two years ago, shippers were dealing with state, federal, and international dangerous goods regulations that were designed solely to prevent an accidental release from harming life and property.

Since the Al Qaeda terrorist attacks on Sept. 11, 2001, though, shippers of hazardous materials have a new mandate. In addition to preventing accidents by properly managing packaging, documentation, transportation, and training, they now are charged with preventing dangerous goods from falling into the wrong hands. New federal regulations make hazmat shippers and carriers responsible for the security of everything from explosives, nuclear materials, and biohazardous substances to household chemicals and common fuels—all of which, we now know, could be used as weapons of mass destruction.

Under the new rules, hazardous material shippers and carriers will have to develop written plans that outline the steps they are taking to secure the movement of goods in a dangerous world. Those plans are supposed to be completed next month. Because the federal government offers few specifics on what's required, however, shippers and carriers may have to apply some common sense to ensure they're meeting their obligations under the law.

The United States Congress acted to combat terrorism almost before the dust and smoke from the Sept. 11 attacks had settled. Several of the laws, regulations, and initiatives that were developed during that period directly or indirectly address hazardous materials transportation. They include the United and Strengthening America by Providing Tools Required to Intercept and Obstruct Terrorism Act (better known as the USA PATRIOT Act), the Safe Explosives Act, the Maritime Transportation Security Act, the Bureau of Customs and Border Protection's Container Security Initiative and Customs-Trade Partnership Against Terrorism, and the reorganization of numerous government agencies under the new Department of Homeland Security (DHS) and the Transportation Safety Administration (TSA).

Among its many provisions, the USA PATRIOT Act, passed only 44 days after Sept. 11, established minimum standards for testing the qualifications of individuals handling and transporting high-hazard materials. They include criminal background checks and measures that limit access to hazardous materials shipments.

On March 25, 2003, the DOT's Research and Special Programs Administration (RSPA) published HM-232, a Final Rule that requires almost every hazmat shipper and carrier to prepare a written transportation security plan. That plan must be completed by Sept. 25, 2003, by any person or company that offers for transportation or transports in commerce one or more of the listed materials in Title 49, Code of Federal Regulations (49 CFR) Part 172, Subpart I, Section 172.800(b).

That list includes highway route-controlled radioactive Class 7 materials; 25 kilograms or more of Class 1.1, 1.2, or 1.3 explosives; and 2,268 kilograms or more of any class of hazardous materials that requires placarding when transported in a motor vehicle, freight container, or rail car. The requirement also applies to anyone shipping a package containing one liter or more of a poison inhalation hazard (PIH) Class 6, Hazard Zone A; a shipment of hazardous materials in bulk packaging with a capacity of 13.24 cubic meters or more; an agent or toxin listed by the Centers for Disease Control and Prevention under 42 CFR, Part 73; or any quantity of hazardous materials requiring the display of a placard.

In its preamble to the final rule, RSPA indicates that there is no template for the required plan. "There is no one-size-fits-all security plan that will be appropriate for each company's individual circumstances; similarly, there is no one-size-fits-all enforcement standard that can be applied," the preamble says.

Despite that disclaimer, HM-232 does require that security plans include three components, as set out in 49 CFR, Part 172, Subpart I, Section 172.802(a). The first covers personnel security, including measures for confirming information for job applicants covered by the security plan. The second addresses unauthorized access to facilities or transport conveyances. The third covers security while hazardous materials are en route from origin to destination, including storage incidental to transportation. In addition, although shippers are not responsible for assessing the effectiveness of carriers' security plans, RSPA has said that shippers must verify that carriers have transportation security plans in place before tendering hazmat cargoes.

HM-232 offers some other general guidelines. "A security plan should represent a company's best, good-faith effort to address identified security risks. If a shipper or carrier determines that the security risks of the materials it handles are relatively small, then its security plan may well be limited in scope and complexity," the rule says. In other words, the security plan for a company that ships five-gallon cans of paint would look significantly different than the plan for a shipper moving cylinders of dinitrogen tetroxide, a toxic gas that is also an oxidizer and a corrosive substance used in rocket fuel.

Regardless of the risks associated with the transportation of specific products, it appears that the risk assessment on which a security plan is based should also include geographical elements, population density, terminal locations, loss-and-damage statistics, and socio-economic factors that might significantly impact the vulnerability of hazmat cargo.

The written security plan, moreover, is not something that is written once and filed away. RSPA requires that it be updated to reflect changing circumstances. The rule also specifies that each plan be made available to all employees who have some responsibility for implementing it. In addition, RSPA's inspectors will look for security plans and training records when they conduct site inspections. "If violations are found, appropriate penalty actions will be initiated," the rule says.

Because the hazmat transportation rules now address security in addition to safety, training for "hazmat employees" must also cover security. (Hazmat employees include anyone who handles, packages, ships, and/or documents hazardous materials for storage and transportation.) HM-232 requires that all recurrent regulatory compliance training conducted after March 26, 2003 must include a component on general awareness of the security requirements.

The rule also says that new hazmat employees must receive security general-awareness training together with hazmat general-awareness training within 90 days of beginning employment. Recurrent training, including a security component, must be completed by all hazmat employees within a three-year period.

HM-232 and the other laws, regulations, and agency reorganizations mentioned earlier already are affecting hazmat shippers' daily activities. Shippers should be aware that international hazmat transportation codes also are being updated to include security requirements. The United Nations Model Regulations, for example, now have a draft chapter that addresses dangerous goods security. The International Maritime Organization (IMO) will begin drafting a security chapter within the International Maritime Dangerous Goods (IMDG) Code next month. And the International Code for the Security of Ships and Port Facilities, to be adopted by the International Convention for the Safety of Life at Sea, will take effect on July 1, 2004.

In spite of all the regulatory rhetoric that has proliferated in the United States and around the world, hazmat transportation security still boils down to common-sense practices. Shippers and carriers have long dealt with cargo security in the context of preventing theft or tampering; many of the practices and technologies they've adopted for those purposes will be appropriate for inclusion in their hazmat security plans.

In short, a careful reading of the rules, together with common-sense application of technology and established security practices, will go a long way toward ensuring that written security plans meet federal requirements.

John V. Currie is president of Currie Associates, a training and consulting firm specializing in hazardous materials regulatory compliance. He also has authored several guidebooks on compliance with hazmat transportation regulations.