This is the accessible text file for GAO report number GAO-03-509R entitled 'Homeland Security: EPA's Management of Clean Air Act Chemical Facility Data' which was released on March 18, 2003. This text file was formatted by the U.S. General Accounting Office (GAO) to be accessible to users with visual impairments, as part of a longer term project to improve GAO products’ accessibility. Every attempt has been made to maintain the structural and data integrity of the original printed product. Accessibility features, such as text descriptions of tables, consecutively numbered footnotes placed at the end of the file, and the text of agency comment letters, are provided but may not exactly duplicate the presentation or format of the printed version. The portable document format (PDF) file is an exact electronic replica of the printed version. We welcome your feedback. Please E-mail your comments regarding the contents or accessibility features of this document to Webmaster@gao.gov. March 14, 2003: The Honorable W.J. “Billy” Tauzin: Chairman, Committee on Energy: and Commerce: House of Representatives: The Honorable John Shimkus: House of Representatives: Subject: Homeland Security: EPA’s Management of Clean Air Act Chemical Facility Data: The events of September 11, 2001, triggered a national re-examination of the security of many of the nation’s critical infrastructures. Following these events, government agencies have struggled to find the right balance between the public’s “right to know” and the dangers of inappropriate public disclosure of sensitive information. Professional and trade groups representing critical infrastructure sectors including the chemical industry generally oppose the release of information regarding the vulnerability of such facilities. These groups argue that terrorists could use this information to target the chemical facilities that are most vulnerable or located near population centers. Other groups support communities’ right to information about hazards to which they might be exposed. Federal, state, and local governments have weighed these factors in reassessing the information publicly available in their publications and on their Web sites. For this reason, the Environmental Protection Agency (EPA) is currently reviewing its management of the chemical facility information it has obtained under Clean Air Act provisions. Regulations promulgated under Section 112(r) of the Clean Air Act as amended in 1990 require chemical facilities that produce, use, or store certain hazardous chemicals beyond threshold amounts to develop a risk management plan (RMP) to detect and prevent or minimize accidental chemical releases. Facilities prepare and submit RMPs to EPA at least every 5 years. RMPs contain data about the types and amounts of hazardous chemicals in covered processes at a facility; a facility’s accident history; accident mitigation and prevention measures that are in place; a facility’s prevention and emergency response program; and the potential effect an accidental chemical release could have on the surrounding population, including whether schools and residences are located within the area potentially affected by a chemical release. Section 112(r) states that RMPs must be made available to the public, as well as to state and local agencies responsible for responding to accidental chemical releases. In a report issued today, we discuss issues surrounding chemical industry security, including the threat posed by chemical facilities, federal requirements addressing chemical facility security and the safe management of chemicals, steps taken by federal agencies to assess and address security, and voluntary industry actions taken to address security concerns.[Footnote 1] As part of our study of issues surrounding chemical industry security, you also asked us to examine EPA’s management of Clean Air Act chemical facility data. In this report we describe EPA’s actions to modify management of RMP data in response to the increased terrorist threat since the events of September 11, 2001. Background: To implement the requirement in the Clean Air Act Amendments of 1990 for public access to chemical facilities’ RMPs, EPA planned to make RMPs including analysis of the potential impact of a chemical release on the surrounding population, referred to as “off-site consequences analysis” (OCA), available to the public over the Internet. However, in response to concerns by Justice’s Federal Bureau of Investigation and other representatives of the law enforcement and intelligence communities, EPA decided not to make the sections of facility RMPs consisting of OCA available on its Web site. Subsequently, Congress enacted legislation that limited access to those sections following testimony expressing concerns about the risk to national security associated with posting RMP data on the Internet. The Chemical Safety Information, Site Security and Fuels Regulatory Relief Act of 1999[Footnote 2] established specific provisions for public access to portions of RMPs that consist of OCA. Specifically, the act made the OCA portions of RMPs and any EPA databases created from those portions unavailable under the Freedom of Information Act for at least one year while the federal government assessed the risks of posting OCA information on the Internet and the benefits of providing public access to the information. The act directed the President to issue regulations at the end of the 1-year period governing distribution of OCA information in a manner that minimizes the likelihood of accidental releases, the increased risk of terrorist or criminal activity associated with posting OCA information on the Internet, and the likelihood of harm to public health and welfare. The act requires that the regulations allow any member of the public to access paper copies of OCA information for a limited number of facilities located anywhere in the U.S. and grants other public access as appropriate. The act also directs that the regulations provide “covered persons,” such as government officials, access to OCA information for official use. The act includes specific limitations on the: dissemination by covered persons of OCA information and any statewide or national ranking derived from that information. In addition, the act establishes criminal penalties for disclosing OCA information in a manner not allowed by the act or regulations. The act did not affect access to other non-OCA RMP information, such as accident history and prevention and emergency response program information. This information remained available through the Internet and the Freedom of Information Act. Final Rule Covers Management of Most RMP Information: Following enactment of the Chemical Safety Information, Site Security and Fuels Regulatory Relief Act, EPA and the Department of Justice (Justice) conducted assessments of the risks of posting OCA information on the Internet and the benefits of providing public access to the information and issued a Final Rule in August 2000 providing methods for access to OCA information.[Footnote 3] The Final Rule established reading rooms as the primary means for the public to access OCA information. In response to the Final Rule, EPA and Justice established 54 reading rooms located across the nation to provide public access to OCA information. EPA operates 17 reading rooms primarily through its regional offices, while Justice operates 37 reading rooms in federal offices around the country.[Footnote 4] The Final Rule allows members of the public to view OCA information for all facilities within the jurisdiction of the local emergency response committee (established under the Emergency Preparedness and Community Right-to-Know Act) in which an individual lives or works and for facilities with potential off-site consequences that could affect that jurisdiction, as well as OCA information for up to 10 facilities per month from any part of the country. Individuals may read facility OCA information, but may not mechanically reproduce or remove this information from the reading room. EPA issued guidance to regional offices on developing reading room procedures in compliance with the Final Rule and reviewed all region-specific management procedures. The Final Rule also allows covered persons, defined by the act and regulations as federal, state, and local government officials, contractors and agents, members of state and local emergency response organizations, and qualified researchers, access to OCA information for official purposes. Federal government officials have access to all OCA information for official use in electronic form or, by request, in paper form. State and local government officials have access to OCA information for facilities located in their state and other states upon request. The Final Rule states that qualified researchers will have access to OCA information under a separate system. However, EPA is not currently developing a system. Covered persons are generally prohibited from disseminating OCA information to the public or to state and local government officials. However, state and local government officials can disseminate the information to other state and local government officials in their state or in a contiguous state. They can also share OCA data elements--pieces of OCA information that are not in the format of restricted OCA portions of RMPs or in the format of EPA’s electronic database. EPA states that it receives hundreds of written requests from covered persons for RMPs including restricted OCA information, and disseminates information in response to these requests in accordance with the Final Rule. Further, the Final Rule makes available on the Internet only OCA data elements that a Justice risk assessment concluded would pose the least security risk if posted on the Internet. The Final Rule specifies that only the following OCA data elements will be available through EPA’s Web site: * concentration and physical state of the facility’s chemical; * duration of the chemical release under the worst-case scenario and the endpoint used for flammable chemicals in the worst-case scenario; * the statistical model used; * wind speed during the chemical release, atmospheric stability, and topography of the surrounding area; and: * safety mitigation systems the facility considered. The Final Rule precludes posting other OCA data elements such as the name and quantity of facilities’ worst-case scenario chemicals, residential population that could be affected by a facility’s worst- case chemical release, and maps or graphics illustrating the worst-case scenario. OCA information and other RMP data may also be available to the public through state and local emergency planning organizations and through chemical facilities. The Final Rule encourages local and state emergency planning organizations to provide read-only access to information about facilities located within an individual’s emergency response jurisdiction or with potential off-site consequences that could affect the jurisdiction. EPA officials told us that while the agency still encourages state and local organizations to share OCA information with the public, it also provides guidance to these organizations on complying with statutory and regulatory restrictions on distributing the information. EPA officials told us that state and local organizations continue to share RMP data and, to a lesser extent, OCA information with the public, but on a more limited basis since September 11, 2001. In addition, the public may receive information about facilities’ risks and potential off-site consequences through public meetings. Virtually all facilities were required by the Chemical Safety Information, Site Security and Fuels Regulatory Relief Act to hold one public meeting to describe and discuss the local effects of their RMPs, including a summary of OCA portions of their RMPs. EPA Has Modified Management of Information, but Further Changes Would Require Legislative or Regulatory Action: In response to heightened concern about terrorist attacks after September 11, 2001, EPA made changes to its dissemination of RMP data. Because of concerns about security, EPA removed the RMP database posted on its Web site on September 20, 2001.[Footnote 5] Furthermore, officials at some EPA regional offices told us they made minor changes to their reading room operations to exercise more caution over OCA information after September 11, 2001. For example, EPA regional officials told us that two regions began conducting limited background checks through the agency’s Criminal Investigation Division units before allowing individuals to access the information. In response, EPA headquarters officials advised regions against implementing additional safeguards inconsistent with the Final Rule. In general, the public has shown limited interest in accessing OCA information, both before and after September 11, 2001. Most EPA reading rooms had not hosted a visit before September 11, 2001. EPA officials report that EPA’s 17 reading rooms hosted about 180 visits in 2002, and a total of more than 200 visits since the reading rooms were created.[Footnote 6] These numbers may include repeated visits by the same individual. Moreover, EPA officials told us that the agency has received 18 requests for RMP data from members of the public by e-mail or in writing; 14 requests were received after September 11, 2001. EPA responded to all requests for RMP data excluding OCA information. The agency provided two additional requesters with the entire RMP database, excluding OCA information and RMP executive summaries. With the consent of these requesters, the agency excluded executive summaries because of increased concern over descriptions of OCA contained in this portion of some facilities’ RMPs. EPA officials reported that changes to the management of RMP data were made in response to the increased threat of terrorist activity, not in response to any breaches in the security of OCA information or the RMP database generally. EPA officials told us that to their knowledge, no unauthorized access to OCA information has occurred. OCA information has been distributed in other formats to members of the public. For example, in several instances, journalists have accessed OCA information in reading rooms and then published lists identifying the most dangerous chemical facilities in a geographic area. These reports included facility names, the toxic chemicals housed at each facility, and the number of people that a chemical release at each facility could potentially affect. Chemical industry groups have voiced concern over this dissemination of facility information, arguing that terrorists could use the information to target facilities that are most vulnerable or located near large population centers. EPA officials also stated that some environmental and public interest groups copied the RMP database, which did not include OCA data elements other than those elements found less sensitive by Justice, from EPA’s Web site prior to September 2001 and made this data available on the Internet. However, officials stated that this information will become outdated as time passes because EPA has not made available the updated facility RMPs it receives. EPA is currently reviewing its management of RMP data. EPA officials are working with Justice to determine whether to put RMPs, excluding restricted OCA information, back on the Internet and whether to restrict public access to other portions of RMPs such as executive summaries, which contain descriptions of OCA information. Even before the events of September 11, 2001, Justice expressed significant concern over general, public access to sensitive information included in chemical facility RMPs, which Justice concluded is particularly attractive targeting information for terrorists. Justice supports draft legislation that would better protect OCA information and prohibit general, public access to OCA information in facility RMPs. Because the existing statutory and regulatory framework governs access to RMPs and OCA information, EPA officials stated that additional changes to the management and distribution of this data would require legislative or regulatory action. Agency Comments and Our Evaluation: We provided a draft of this letter to EPA for its review and comment. EPA agreed with the letter’s facts and provided technical comments and clarifications, which we incorporated as appropriate. Scope and Methodology: To determine EPA’s management of Clean Air Act data under the Section 112(r) Risk Management Plan provisions, we interviewed officials from EPA headquarters and officials from EPA’s 10 regional offices. We also reviewed statutes and regulations to determine the relevant statutory framework. In addition, we spoke with Justice about the agency’s procedures for operating reading rooms. We conducted our work from April 2002 through March 2003 in accordance with generally accepted government auditing standards. As agreed with your office, unless you publicly announce the contents of this report earlier, we plan no further distribution of it until 30 days after the date of this letter. At that time, we will send copies to other interested parties and make copies available to others who request them. In addition, the report will be available on GAO’s Web site at http://www.gao.gov. If you or your staff have any questions about this letter, please contact me or Peg Reese at (202) 512-3841. Major contributors to this report were Paige Gilbreath, Joanna McFarland, Amy Webbink, and Leigh White. John B. Stephenson Director, Natural Resources and Environment: (360311): FOOTNOTES [1] U.S. General Accounting Office, Homeland Security: Voluntary Initiatives Are Under Way at Chemical Facilities, but the Extent of Security Preparedness Is Unknown (GAO-03-439, Mar. 14, 2003). [2] P.L. 106-40, 113 Stat. 207 (1999). [3] 65 Fed. Reg. 48108 (Aug. 4, 2000). [4] Justice generally administers its reading rooms similarly to EPA reading rooms. [5] Non-OCA RMP information remained available through the Freedom of Information Act. [6] Justice reports that its 37 reading rooms have hosted fewer than 50 visits.