Congress Let the Chemical Security Law Lapse. The 2027 Budget Finishes the Job.

For fifteen years, a facility holding enough ammonium nitrate or chlorine gas to injure a neighborhood had to answer to the Chemical Facility Anti-Terrorism Standards program: report the chemicals, accept a federal risk tier, build a security plan, submit to inspection, vet anyone who touched the material against the terrorist watchlist.▸ Then, on July 28, 2023, the law authorizing all of it expired, and Congress has not reauthorized it since. The people who ran it didn't leave. They kept showing up to a program with no legal authority to do the job it was built for — and the budget now in front of Congress proposes to send them home too.

CFATS was Congress's direct answer to 9/11: a standing federal authority to identify facilities holding dangerous chemicals, tier them by risk, and force the highest-risk sites to prove they'd secured the material.▸ It worked by reauthorization, renewed on a schedule for a decade and a half — until the House-passed extension bill, which cleared on a 409-1 vote, stalled in the Senate and the underlying statute expired anyway. The Congressional Research Service traces the exact mechanics: H.R. 4470 passed the House 409-1; a Senate companion, S. 2499, never advanced past introduction; a motion to take up the House bill was blocked on the floor days before the chamber left for its summer recess. The authority lapsed at midnight, July 28, 2023, and nothing has replaced it since — not a short-term patch, not a new bill, not a rider on a defense authorization. Bipartisan amendments to reinsert CFATS into the FY2025 and FY2026 National Defense Authorization Acts were both kept off the House floor by the Rules Committee.

CISA's own chemical-security leadership has been the most candid source on what stopped.▸ Before the lapse, inspectors ran an average of 160 site visits a month — more than a third of them turned up a security gap that then got fixed. The same program vetted an average of 300 names a day, roughly 9,000 a month, against the Terrorist Screening Database before anyone got access to a facility's dangerous chemicals. Four months into the lapse, CISA estimated that figure had produced roughly 36,000 personnel access decisions made with no terrorist-database check at all, plus at least 200 new high-risk facilities the agency could no longer identify, because the legal requirement to report new chemical holdings had lapsed along with everything else.

The last time CISA had legal authority to update its national map of high-risk chemical sites, the count stood at 3,200 facilities, drawn from more than 40,000 screened over the program's life — 28% of them sitting in the country's largest urban areas.▸ That count is frozen at October 2023 by design: without CFATS, facilities have no legal obligation to tell CISA when their chemical holdings change, so the agency's own leadership has written plainly that it "no longer has an accurate national profile" of where the material is. Frozen or not, the last real count put more than 7,000 schools, colleges, and universities, and more than 300 hospitals, within a single mile of one of those sites.

The one legal substitute for personnel vetting, the Terrorist Screening Database check, has no voluntary equivalent — a facility cannot opt into a background check CISA no longer has authority to run.▸ The only thing CISA still offers is ChemLock, a no-cost, opt-in advisory program with no inspection power and no ability to compel a single security upgrade. It is, in the words of the CISA official who runs it, "in no way a replacement for CFATS."

Reauthorizing CFATS would cost Congress a floor vote it has twice declined to hold.▸ Defunding what's left of it took one budget request — twice. DHS's Fiscal Year 2026 congressional budget justification proposed eliminating all 224 positions, all 178 FTE, and $40.0 million of the program's $52.5 million base — a request Congress didn't fully adopt, since a smaller version of the program, 223 positions and $35.1 million, carried into the next year's budget anyway. DHS's Fiscal Year 2027 budget justification proposes taking all of that too: 223 positions, 194 FTE, $35.076 million — 100% of what remains, described in the document itself as "the result of the expiration of statutory authorities." Both the Chemical Security Inspectors and the voluntary ChemLock program they run would go with it.

Set against CISA's $390.8 million Infrastructure Security Division, the program being proposed for zero is a rounding error: about 9% of the division's budget.▸ Set against the communities near those 3,200 sites, it's the entire remaining federal chemical-security workforce — every inspector, every vetting check, every voluntary consultation — going to zero at once, three and a half years after the law that authorized any of it already did.

Figures on program history, inspections, and personnel vetting come from two CISA leadership statements written three and four months into the 2023 lapse; the facility, school, and hospital counts they cite were the last full CFATS accounting and have not been updated since, by CISA's own account. Budget figures come from DHS's FY2026 and FY2027 congressional budget justifications for CISA; the FY2027 "everything else" figure is a simple subtraction of two disclosed totals, not an independently itemized DHS line.