Summary
The events of September 11, 2001, triggered a national re-examination of the security of thousands of industrial facilities that use or store hazardous chemicals in quantities that could potentially put large numbers of Americans at risk of serious injury or death in the event of a terrorist-caused chemical release. GAO was asked to examine (1) available information on the threats and risks from terrorism faced by U.S. chemical facilities; (2) federal requirements for security preparedness and safety at facilities; (3) actions taken by federal agencies to assess the vulnerability of the industry; and (4) voluntary actions the chemical industry has taken to address security preparedness, and the challenges it faces in protecting its assets and operations.
Chemical facilities may be attractive targets for terrorists intent on causing economic harm and loss of life. Many facilities exist in populated areas where a chemical release could threaten thousands. EPA reports that 123 chemical facilities located throughout the nation have toxic "worst-case" scenarios where more than a million people in the surrounding area could be at risk of exposure to a cloud of toxic gas if a release occurred. To date, no one has comprehensively assessed the security of chemical facilities. No federal laws explicitly require that chemical facilities assess vulnerabilities or take security actions to safeguard their facilities from attack. However, a number of federal laws impose safety requirements on facilities that may help mitigate the effects of a terrorist-caused chemical release. EPA believes that the Clean Air Act could be interpreted to provide authority to require chemical facilities to assess their vulnerabilities and to make security enhancements that protect against attacks. However, EPA has not attempted to use these Clean Air Act provisions because of concerns that this interpretation would pose significant litigation risk and has concluded that chemical facility security would be more effectively addressed by passage of specific legislation. The federal government has not comprehensively assessed the chemical industry's vulnerabilities to terrorist attacks. EPA, the Department of Homeland Security, and the Department of Justice have taken preliminary steps to assist the industry in its preparedness efforts, but no agency monitors or documents the extent to which chemical facilities have implemented security measures. Consequently, federal, state, and local entities lack comprehensive information on the vulnerabilities facing the industry. To its credit, the chemical industry, led by its industry associations, has undertaken a number of voluntary initiatives to address security at facilities. For example, the American Chemistry Council, whose members own or operate 1,000, or about 7 percent, of the facilities subject to Clean Air Act risk management plan provisions, requires its members to conduct vulnerability assessments and implement security improvements. The industry faces a number of challenges in preparing facilities against attacks, including ensuring that all chemical facilities address security concerns. Despite the industry's voluntary efforts, the extent of security preparedness at U.S. chemical facilities is unknown. Finally, both the Secretary of Homeland Security and the Administrator of EPA have stated that voluntary efforts alone are not sufficient to assure the public of industry's preparedness.
Recommendations
Our recommendations from this work are listed below with a Contact for more information. Status will change
from "In process" to "Implemented" or "Not implemented" based on our follow up work.
Director:
Team:
Phone:
No director on record
No team on record
No phone on record
Recommendations for Executive Action
Recommendation: In order to ensure that chemical facilities take action to review and address security vulnerabilities, the Secretary of Homeland Security and the Administrator of EPA should jointly develop, in consultation with the Office of Homeland Security, a comprehensive national chemical security strategy that is both practical and cost effective. This national strategy should identify high-risk facilities based on factors including the level of threat and collect information on industry security preparedness.
Agency Affected: Department of Homeland Security: Directorate of Emergency Preparedness and Response
Status: Implemented
Comments: DHS identified high risk chemical facilities using EPA's Risk Management Plan database. It also developed a Risk Analysis Management for Critical Asset Protection (RAMCAP) for collecting information on critical infrastructure assets. With this tool, DHS would be able to compare risks across assets. Under the new regulatory environment, owners of facilities housing certain quantities of specified chemicals must complete a preliminary screening assessment to determine the level of risk associated with the facility. If the facility preliminarily qualifies as high risk its owners will be required to prepare and submit a Security Vulnerability Assessment (SVA), which identifies facility security vulnerabilities, and to develop and implement a Site Security Plan, which includes measures to address vulnerabilities identified in the SVA, and satisfy risk-based performance standards established in the regulations. The regulations use a risk-based performance standards approach. Facilities have flexibility in designing their Site Security Plans and in choosing what security measures to use to meet the security standards required of their facility. Facilities will, however, be required to achieve specific security outcomes, such as securing the perimeter and critical targets, controlling facility access, and preventing internal sabotage. The security standards a facility must meet will be commensurate to their risk i.e., higher risk facilities will be required to meet more robust security standards. Security Vulnerability Assessments, Site Security Plans, and the implementation of security measures will be validated through audits and site inspections.
Agency Affected: Environmental Protection Agency
Status: Implemented
Comments: At the time of this review, EPA was named in national strategies issued in July 2002 and February 2003 as the lead agency for chemical security. A 2003 Presidential directive designated DHS the lead agency in December 2003, and DHS has, in effect, implemented these recommendations on EPA's behalf.
Recommendation: In order to ensure that chemical facilities take action to review and address security vulnerabilities, the Secretary of Homeland Security and the Administrator of EPA should jointly develop, in consultation with the Office of Homeland Security, a comprehensive national chemical security strategy that is both practical and cost effective. This national strategy should specify the roles and responsibilities of each federal agency partnering with the chemical industry.
Agency Affected: Department of Homeland Security: Directorate of Emergency Preparedness and Response
Status: Implemented
Comments: A 2003 Presidential directive designated DHS the lead agency in December 2003. And, in fall 2006, Congress granted DHS overarching regulatory authority over chemical facility security. The National Infrastructure Protection Plan (NIPP) provides the unifying structure for the integration of critical infrastructure and key resources protection efforts into a single national program. The NIPP provides an overall framework for integrating programs and activities that are underway in the various sectors, as well as new and developing sector protection efforts. The NIPP includes 17 sector-specific plans that detail the application of the overall risk management framework to each specific sector. In May 2007, DHS released the Chemical Sector Specific Plan. The plan describes how the NIPP risk management framework-the six-step process for managing the risks associated with the Nation's critical infrastructure from terrorist attack-is being implemented in and integrated with both the voluntary programs already underway in the Chemical Sector and the recently enacted chemical facility security regulatory standards. DHS notes in the Chemical Sector Specific Plan that numerous other federal departments and agencies have responsibilities that are integral to the overall security of the section. The numerous federal agencies involved in chemical security has a formal entity for coordinating government led protection activities called the Chemical Government Coordinating Council (CGCC), which is chaired by DHS.
Agency Affected: Environmental Protection Agency
Status: Implemented
Comments: At the time of this review, EPA was named in national strategies issued in July 2002 and February 2003 as the lead agency for chemical security. A 2003 Presidential directive designated DHS the lead agency in December 2003, and DHS has, in effect, implemented these recommendations on EPA's behalf.
Recommendation: In order to ensure that chemical facilities take action to review and address security vulnerabilities, the Secretary of Homeland Security and the Administrator of EPA should jointly develop, in consultation with the Office of Homeland Security, a comprehensive national chemical security strategy that is both practical and cost effective. This national strategy should develop appropriate information sharing mechanisms.
Agency Affected: Department of Homeland Security: Directorate of Emergency Preparedness and Response
Status: Implemented
Comments: Currently, DHS has numerous methods through which it disseminates information to, and receives information from, private sector members of the Chemical Sector, the most substantial of which is the Chemical ISAC. The DHS also has developed a secure, online information-sharing network for the Chemical Sector called HSIN-Chemical. Currently, representatives from Chemical ISAC and HSIN-Chemical are working together to determine how these two systems can be integrated to best serve the interests of the Chemical Sector.
Agency Affected: Environmental Protection Agency
Status: Implemented
Comments: At the time of this review, EPA was named in national strategies issued in July 2002 and February 2003 as the lead agency for chemical security. A 2003 Presidential directive designated DHS the lead agency in December 2003, and DHS has, in effect, implemented these recommendations on EPA's behalf.
Recommendation: In order to ensure that chemical facilities take action to review and address security vulnerabilities, the Secretary of Homeland Security and the Administrator of EPA should jointly develop, in consultation with the Office of Homeland Security, a comprehensive national chemical security strategy that is both practical and cost effective. This national strategy should develop a legislative proposal, in consultation with industry and other appropriate groups, to require these chemical facilities to expeditiously assess their vulnerability to terrorist attacks and, where necessary, require these facilities to take corrective action.
Agency Affected: Department of Homeland Security: Directorate of Emergency Preparedness and Response
Status: Implemented
Comments: In fall 2006, Congress granted DHS overarching authority to regulate chemical facility security. Specifically, in Section 550 of the Department of Homeland Security Appropriations Act of 2007, Congress gave DHS the authority to require high risk chemical facilities to complete vulnerability assessments, develop site security plans, and implement protective measures necessary to meet DHS-defined performance standards. In accordance with this authority, on April 2, 2007, DHS released the Chemical Facility Anti-Terrorism Standards (CFATS) as an interim final rule.
Agency Affected: Environmental Protection Agency
Status: Implemented
Comments: At the time of this review, EPA was named in national strategies issued in July 2002 and February 2003 as the lead agency for chemical security. A 2003 Presidential directive designated DHS the lead agency in December 2003, and DHS has, in effect, implemented these recommendations on EPA's behalf.
