This is the accessible text file for GAO report number GAO-03-24R entitled 'Homeland Security: Department of Justice's Response to Its Congressional Mandate to Assess and Report on Chemical Industry Vulnerabilities' which was released on October 10, 2002. This text file was formatted by the U.S. General Accounting Office (GAO) to be accessible to users with visual impairments, as part of a longer term project to improve GAO products’ accessibility. Every attempt has been made to maintain the structural and data integrity of the original printed product. Accessibility features, such as text descriptions of tables, consecutively numbered footnotes placed at the end of the file, and the text of agency comment letters, are provided but may not exactly duplicate the presentation or format of the printed version. The portable document format (PDF) file is an exact electronic replica of the printed version. We welcome your feedback. Please E-mail your comments regarding the contents or accessibility features of this document to Webmaster@gao.gov. October 10, 2002: The Honorable John D. Dingell: Ranking Minority Member: Committee on Energy and Commerce: House of Representatives: The Honorable Frank Pallone, Jr. Ranking Minority Member: Subcommittee on Environment and Hazardous Materials: Committee on Energy and Commerce: House of Representatives: Subject: Homeland Security: Department of Justice’s Response to Its Congressional Mandate to Assess and Report on Chemical Industry Vulnerabilities: On August 5, 1999, after a number of testimonies expressing concerns about the vulnerability of chemical facilities[Footnote 1] to criminal and terrorist attacks, Congress passed the Chemical Safety Information, Site Security and Fuels Regulatory Relief Act (CSISSFRRA),[Footnote 2] which, among other things, required the Department of Justice to review the vulnerability of these facilities. The act also required the Attorney General to prepare two reports--an interim report containing preliminary findings by August 5, 2000, and a final report by August 5, 2002. Specifically, Justice was to address the extent to which Clean Air Act regulations regarding the prevention of accidental releases have resulted in actions, including the design and maintenance of safe chemical facilities, that are effective in detecting, preventing, and minimizing the consequences of regulated substances that may be released as a result of criminal activity. Furthermore, using available data to the extent possible and a sample of facilities, and consulting with appropriate state, local, and federal government agencies, affected industry, and the public, Justice was to review the vulnerability of chemical facilities to criminal and terrorist activity, current industry practices regarding site security, and the security of transportation of regulated substances. Finally, Justice was to include recommendations, if any, for reducing the vulnerability of these facilities to criminal and terrorist activities. The interim report was to include, at a minimum, preliminary findings from this review, the methods used to develop the findings, and an explanation of the activities expected to occur that could cause the findings in the final report to differ from those in the interim report. The final report was to discuss the complete results of the review. CSISSFRRA authorized to be appropriated such sums as necessary to carry out the requirements. In a separate but related action, the October 2000 Conference report[Footnote 3] on Justice’s appropriation act for fiscal year 2001 directed Justice to use $600,000 of the Office of Justice Programs, Justice Assistance appropriation for its National Institute of Justice to develop, test, and validate a prototype vulnerability assessment methodology to assess the security of chemical facilities against terrorist and criminal acts, consistent with the CSISSFRRA requirements.[Footnote 4] As part of our ongoing study of chemical industry security, you asked us to describe Justice’s actions to comply with the 1999 congressional mandate to review and report on the vulnerability of chemical facilities. This report responds to that request. As agreed, we will report early next year on other issues concerning the security of chemical facilities. Justice Initiated Actions to Study the Vulnerability of the Chemical Industry but Has Not Fully Met Its Statutory Requirements: Justice has only partially fulfilled the requirement to review and report on the vulnerability of chemical facilities to terrorist or criminal attack. Justice prepared and submitted an interim report to Congress in May 2002. The interim report was based on observations made at 11 chemical manufacturing facilities Justice visited in developing a methodology requested by its appropriations conference committee. The facilities visited represent only a small portion of the 15,000 chemical facilities subject to the Clean Air Act’s risk management plan provisions. While the interim report contains the elements required by CSISSFRRA, it was submitted nearly 2 years after it was due, and the results cannot be generalized to the industry as a whole. Additionally, Justice did not submit its final report to Congress by August 5, 2002, as required. Justice told us that because of competing priorities in its budget, it had not yet conducted a more comprehensive final study. While Justice determined that it did not have adequate funds to conduct the study of the vulnerability of chemical facilities to attack, it did not formally request additional funds from Congress for this purpose in fiscal year 2001 or 2002. Justice has asked for $3 million in its fiscal year 2003 budget request and plans to conduct the study and issue the final report if it receives these funds. We note that Justice should have used its existing appropriations for the study. Generally, when Congress imposes a new requirement on an agency but does not appropriate funds specifically to implement it, the agency must use existing appropriations to fund the requirement.[Footnote 5] Justice’s Interim Report Was Based on Observations Made While Developing a Methodology to Assess Chemical Facilities’ Vulnerability to Terrorist Attack: Justice determined that the first step in meeting the CSISSFRRA requirements was to develop a methodology to assess the security of chemical facilities. On March 31, 2000, the Justice submitted notice to the House and Senate Committees on Appropriations that it planned to transfer $750,000 from the Counterterrorism appropriation to the Office of Justice Programs appropriation to develop a methodology. According to Justice, the committees disagreed with the transfer and Justice elected not to proceed with it. A conference committee later directed Justice to use $600,000 of the Office of Justice Programs, Justice Assistance appropriation for the department’s National Institute of Justice to develop, test, and validate a prototype vulnerability assessment methodology to assess the security of chemical facilities against terrorist and criminal acts, consistent with the CSISSFRRA requirements.[Footnote 6] In January 2001, Justice, together with the Department of Energy’s Sandia National Laboratory, began developing, testing, and validating the vulnerability assessment methodology. The methodology provides a tool to identify risks and mitigate the consequences of terrorist attacks. In July 2002, Justice made the completed methodology publicly available to assist chemical companies in identifying and assessing their threats, risks, and vulnerabilities. In addition, chemical industry associations are encouraging their members to use this methodology to evaluate their facilities. On the basis of observations made during the development of the methodology, Justice prepared a 12-page interim report to Congress in response to the CSISSFRRA requirement. Justice determined that the report contains information that if released would pose a threat to national security and therefore has not made it publicly available.[Footnote 7] As required, the interim report (1) provides preliminary findings, (2) discusses the methods used to develop those findings, (3) includes Justice’s recommendations for reducing the vulnerability of facilities to terrorist activity, and (4) explains activities expected to occur that could result in differences between the findings in the interim and final reports. The interim report does not assess overall security at chemical facilities, but rather, it provides observations Justice made about security at a few facilities during the development of the methodology. Interim Report’s Preliminary Findings: The interim report discusses two preliminary findings that address the extent to which the Clean Air Act’s accidental release regulations have resulted in actions that are effective in detecting, preventing, and minimizing the consequences of releases of regulated substances that may be caused by criminal and terrorist activity. According to the report, chemical facilities visited generally had safety and emergency response measures that could mitigate the consequences of a terrorist attack.[Footnote 8] The report further stated that the level of security at chemical facilities is roughly equivalent to standard security practices found in most industries. However, we could not determine from our discussions with Justice officials what work was performed to support this finding, and we are continuing to investigate this issue as part of our ongoing review. The interim report also contains nine preliminary findings that cumulatively address the other required reporting elements--the vulnerability of facilities to criminal and terrorist activity, current industry site security practices, and the security of chemicals being transported. These findings address the extent to which the 11 facilities: * conducted facility security assessments, * had the capability to respond to armed attacks, * conducted emergency response exercises, * conducted routine pre-employment background investigations, * had secure process control systems, * had secure chemical transportation containers, * had adequate security measures over transportation of hazardous chemicals, * received meaningful threat information, and: * had effective facility security systems. Concerning transportation, Justice officials told us that their observations to date were limited to the transportation of chemicals within a facility and that a broader review of transportation vulnerabilities outside a facility is needed. Methods Used to Develop Preliminary Findings: Justice’s preliminary findings are based on the work that it and Sandia did to develop the vulnerability assessment methodology. Consequently, the scope and limitations of the interim report’s preliminary findings are the same as those for the methodology. In developing the methodology, Justice identified approximately 15,000 U.S. facilities that produce, dispose of, or in some manner handle or use hazardous chemicals. Justice focused on chemical facilities that manufactured chemicals hazardous to human life. These were chemicals that, if inhaled or touched by individuals, would cause harmful or lethal results. To develop and test the methodology, Justice and Sandia personnel met with industry and government officials and visited 11 chemical manufacturing facilities from April 2001 through January 2002. These facilities were selected in consultation with personnel from the American Chemistry Council, the chemical manufacturing industry’s trade association, who suggested that the security at these facilities was representative of a broad range of facilities in the industry. These facilities represented a range of characteristics such as (1) location- -six urban and five rural sites and (2) the number of employees--three had more than 1,000 employees, three had fewer than 100 employees, and the remaining five ranged from 100 to 1,000 employees. Justice and Sandia focused primarily on physical security at fixed sites--the security of electronic chemical process control systems and transportation systems was a secondary focus. Because the findings in the interim report are based on visits to only 11 facilities, the report states that caution should be exercised in generalizing the findings to the entire industry. However, the report also notes that these visits provided the department with the opportunity to identify potential threats, overall risks, and vulnerabilities at these chemical facilities. Also, according to Justice, chemical facilities that store and use chemicals may present fundamentally different security concerns than chemical facilities that produce or manufacture chemicals--such as those included in the Justice study--and that, as such, the preliminary findings and recommendations may not apply other than to manufacturing facilities. It is important to note that of the approximately 15,000 facilities covered by the Clean Air Act, according to an official at the Environmental Protection Agency, only about 1,500 produce or manufacture chemicals. Interim Report Recommendations: The interim report notes that in addition to the use of effective security systems, other remedial measures should be considered to lower the probability of a successful terrorist attack. Justice officials told us that these recommendations apply to the 11 facilities they visited and may not be applicable to other chemical facilities. While Justice has not made the recommendations publicly available, officials said that chemical facilities would be able to identify measures to potentially lower the probability of a successful terrorist attack when they conduct their own vulnerability assessments. Potential Differences Between the Interim and Final Reports: Justice notes that its report is based primarily on information and practices developed prior to September 11, 2001, and therefore the findings in a final report may differ in some respects from those in the interim report. Furthermore, some chemical manufacturers have altered their security measures since September 2001, and those changes may not be fully reflected in the interim report. According to Justice officials, Sandia visited five facilities prior to, and six after, September 11, 2001. Justice Does Not Plan to Conduct the Study and Issue the Final Report Unless Congress Provides Requested Funding: According to Justice officials, Justice did not comply with the CSISSFRRA requirement to issue the final report by August 5, 2002, because it determined that it did not have adequate funds in its existing budget and Congress has not provided funds specifically for this purpose.[Footnote 9] Justice has estimated the study would cost: $7 million, but did not provide the basis for this estimate. And while Justice could not identify funds to conduct a study of the security of the chemical industry, it did not ask Congress for funds for this purpose in fiscal year 2001 or 2002, or in the supplemental appropriations for either year. Justice has requested $3 million as part of its lump sum appropriation for Salaries and Expenses, General Administration for fiscal year 2003 for “chemical plant vulnerability assessments.”[Footnote 10] According to officials, Justice does not plan to conduct any further work to assess the vulnerability of the chemical industry, nor does it plan to issue the final report to Congress unless Congress enacts the lump sum appropriation in the amount Justice has requested. Nevertheless, while Justice’s appropriations acts have not provided the department an earmark or a specific line item appropriation for this purpose, Justice does have appropriations legally available for this purpose. Justice is authorized to use its existing and available lump sum appropriations for this purpose. Generally, when Congress imposes a requirement but does not appropriate additional funds to specifically carry it out, an agency must use an existing appropriation to implement the requirement--one that is consistent with the purposes of the particular appropriation being charged for that expense.[Footnote 11] Justice’s interim report recognizes that a vulnerability assessment would help identify and set priorities for security vulnerabilities at chemical facilities, compare security risks across chemical facilities, and help companies make the best use of security funding and other resources to address priority vulnerabilities. Furthermore, according to the administration’s July 2002 National Strategy for Homeland Security, comprehensive vulnerability assessments of critical infrastructures enable authorities to evaluate the potential effects of an attack on a given facility or sector and to invest accordingly. Agency Comments and Our Evaluation: We provided a draft of this report to the Department of Justice for its review and comment. Justice agreed with the majority of the observations contained in the report. However, Justice expressed concern that we did not place its efforts in the proper context when we observed that it did not use available funds to address the comprehensive reporting requirements included in CSISSFRRA. Justice also explained the notification provisions found in section 605 of its appropriations acts. We recognized the initial efforts Justice made to address the reporting requirements included in CSISSFRRA. As we stated in our report, Justice has partially addressed the CSISSFRRA mandate by preparing an interim report. We also reported that Justice notified the House and Senate Committees on Appropriations that it planned to transfer $750,000 from its Counterterrorism appropriation to develop a methodology. This notice explained that this money would fund phase one of its project to prepare a report required by CSISSFFRA. As Justice explains in its comments to us, section 605 of its appropriations acts required it to notify the committees of its proposal to use these funds. As we reported, the appropriations committees disagreed with this transfer and Justice elected not to proceed. Later, a conference committee directed Justice to use $600,000 to develop, test, and validate a prototype vulnerability assessment methodology. While Justice proposed to use $750,000 in 2000 for the first step in meeting the CSISSFRRA requirements, it did not attempt to use funds from any other appropriations or ask Congress for funds to complete a study of the security of the chemical industry until fiscal year 2003. As we stated in the report, we believe that when Congress imposes a new requirement on an agency but does not appropriate funds specifically to implement it, the agency must use existing appropriations to fund the requirement. The Department of Justice’s letter to us is contained in enclosure I. Scope and Methodology: To describe Justice’s actions to review the vulnerability of the chemical industry against criminal and terrorist acts and to fulfill its statutorily mandated reporting requirements, we reviewed the requirements of the Chemical Safety Information, Site Security and Fuels Regulatory Relief Act and Justice’s appropriations for fiscal years 2000 to 2003 and interviewed Justice officials. We reviewed a copy of the interim report Justice submitted to Congress and of the vulnerability assessment methodology developed by Justice and Sandia. We requested a meeting with the Justice and Sandia personnel who were directly involved with making the observations on facility security, which was the basis for the interim report, but to date, Justice has not provided us access to them. We performed our review from April 2002 through August 2002 in accordance with generally accepted government auditing standards. We are sending copies of this report to interested congressional committees. We also will make copies available to others upon request. In addition, the report will be available at no charge on the GAO Web site at http://www.gao.gov. If you have any questions about this report, please contact me at (202) 512-3841. Major contributors to this report were Linda Libician, Leigh White, Amy Webbink, and Joanna McFarland. John B. Stephenson: Director, Natural Resources andEnvironment: Signed by John B. Stephenson: Enclosure: Enclosure I: Comments from the U.S. Department of Justice: U.S. Department of Justice: Washington, D.C 20530: OCT - 3 2002: Mr. John Stephenson: Director, Natural Resources and Environment U.S. General Accounting Office: 441 G Street, NW Washington, D.C. Dear Mr. Stephenson: Thank you for the opportunity to review the final draft of the General Accounting Office (GAO) report, entitled “Homeland Security: Justices’s Response to Its Congressional Mandate to Assess and Report on Chemical Industry Vulnerabilities, GAO-02-1066R.” This letter constitutes the formal comments of the Department of Justice, and I request that it be included in the final report. The report makes a number of observations concerning the Department’s actions and statutory requirements to review and report on the vulnerability of chemical facilities to a terrorist or criminal attack. While the Department agrees with the majority of the observations contained in the report, we believe the GAO observation that the Department did not use available funds to address the comprehensive reporting requirements included in the Chemical Safety Information, Site Security and Fuels Regulatory Relief Act (CSISSFRRA) does not place our efforts in the proper context. The report states that “generally” when Congress imposes a new requirement on an agency but does not appropriate funds specifically to implement it, the agency must use existing appropriations to fund the requirement. While as a general matter this is true, the use of the Department’s available funding for new programs, projects, or activities not specifically requested in a budget request or funded in an appropriations act is restricted by Section 605 of our annual appropriations acts. Section 605(a) requires that the Committee on Appropriations be notified 15 days prior to the Department using any appropriated monies or monies made available to the Department through the collection of fees, and prior to using in excess of $500,000 or 10 percent, whichever is less. The Department complied with Section 605 requirements in developing a funding mechanism for the Congressionally-mandated study cited in your report, and the proposal was then objected to by the Congress. Since the early 1980’s, the annual Commerce, Justice, and State, the Judiciary and Related Agencies Appropriations Act has contained a general provision that establishes by law how and when the Committees on Appropriation are to be notified about changes in the way the Department executes its budget. While the Committees recognize that there will be changes during the operating year that may require a different allocation of resources and changes in program emphasis as priorities change, the Department is required by law to notify the Committees of such changes. Specifically, section 605(a) requires that the Committees on Appropriations be notified 15 days prior to the Department using any appropriated monies or monies made available to the Department through the collection of fees (available in the current or any prior fiscal year) to: * Create a new program(s); * Eliminate a program, project, or activity; * Increase funds or personnel by any means for any project or activity for which funds have been denied or restricted; * Relocate an office or employees * Reorganize offices, programs, or activities Contract out or privatize any functions, or activities presently performed by Federal employees. In addition, section 605(b) requires that the Committees on Appropriations be notified 15 days prior to the Department using in excess of $500,000 or 10 percent, whichever is less: * To augment existing programs, projects or activities; * To reduce by 10 percent funding for any existing program, project, or activity, or numbers of personnel by 10 percent as approved by Congress; or: * That result from any general savings from a reduction in personnel which would result in a change in existing programs, activities, or projects as approved by both Houses of Congress. Use of the Attorney General’s Counterterrorism Fund, as the Department proposed in its March 31, 2000 notification, are subject to the requirements of Section 605. Thus, after Congress passed the CSISSFRRA, the Department made efforts, consistent with law governing use of its appropriations, to fund the required report. The notice informed Congress of the Department’s plans to transfer $750,000 from the Attorney General’s Counterterrorism Fund appropriation to the Office of Justice Programs appropriation to develop a methodology. The Appropriations Committees objected to the transfer, and the Department did not proceed with it. However, as mentioned in your report, in the Department’s FY 2001 Appropriations Act, the Congress did provide $600,000 to develop, test, and validate a prototype national Vulnerability Assessment (VA) methodology for assessing the security of chemical facilities against terrorist and criminal attacks, consistent with the requirements of PL 106-40 and to provide a comprehensive report on the findings derived from the development of the VA methodology. This report was transmitted to the Committees on Appropriations on May 28, 2002. In addition, the first report required under CSISSFRRA was transmitted to the Congress on May 30, 2002. Finally, we recommend that the full discussion of the Department’s actions regarding funding of the study should be included under the heading “Justice Initiated Actions to Study the Vulnerability of the Chemical Industry but Has Not Fully Met its Statutory Requirements,” rather than under the next heading. Again, we appreciate the GAO giving the Department an opportunity to comment in this process and thank the Congress for its support in our continuing efforts to improve our Homeland Security. If you have any questions concerning the Department’s comments you may contact Vickie L. Sloan, Director, Audit Liaison Office on (202) 514-0469. Sincerely, Robert F. Diegelman: Acting Assistant Attorney General for Administration: Signed by Robert F. Diegelman: FOOTNOTES [1] We use the term “chemical facilities” in this report to mean those stationary sources covered under section 112(r) of the Clean Air Act. [2] Pub. L. No. 106-40, 113 Stat. 207 (1999). [3] H.R. Conf. Rept. No. 106-1005, at 223 (2000). [4] The Departments of Commerce, Justice, and State, the Judiciary, and Related Agencies Appropriations Act for fiscal year 2001, Pub. L. No. 106-553, 114 Stat. 2762, was not enacted until December 21, 2000. [5] See B-195007, July 15, 1980; 46 Comp. Gen. 604 (1967); 15 Comp. Gen. 167 (1935). [6] The October 2000 Conference report on Justice’s appropriation act for fiscal year 2001 directed this action. Additionally, the Conference report required Justice to submit a report on the findings derived from the development of the methodology. Justice submitted this report to its appropriations committees in May 2002. [7] Justice made this determination pursuant to 42 U.S.C. 7412(r)(7)(H)(xi)(III). [8] We only discuss selected information from the interim report that Justice has determined does not pose a threat to national security. [9] However, CSISSFRRA authorizes such funds as may be necessary to be appropriated to Justice to conduct the study and report on the vulnerability of chemical facilities. [10] Department of Justice, Fiscal Year 2003 Budget Summary, Salaries and Expenses, General Administration, Department Leadership. [11] See B-195007, July 15, 1980; 46 Comp. Gen. 604 (1967); 15 Comp. Gen. 167(1935).