[Senate Hearing 109-175]
[From the U.S. Government Publishing Office]



 
                                                       S. Hrg. 109-175

 IS THE FEDERAL GOVERNMENT DOING ENOUGH TO SECURE CHEMICAL FACILITIES 
                     AND IS MORE AUTHORITY NEEDED?

=======================================================================

                                HEARING

                               before the

                              COMMITTEE ON
              HOMELAND SECURITY AND GOVERNMENTAL AFFAIRS
                          UNITED STATES SENATE


                       ONE HUNDRED NINTH CONGRESS

                             FIRST SESSION




                               __________

                             JUNE 15, 2005

                               __________

                       Printed for the use of the

        Committee on Homeland Security and Governmental Affairs






                 U.S. GOVERNMENT PRINTING OFFICE

21-829                 WASHINGTON : 2005
_________________________________________________________________
For sale by the Superintendent of Documents, U.S. Government 
Printing  Office Internet: bookstore.gpo.gov  Phone: toll free 
(866) 512-1800; DC area (202) 512-1800 Fax: (202) 512-2250 Mail:
Stop SSOP, Washington, DC 20402-0001




        COMMITTEE ON HOMELAND SECURITY AND GOVERNMENTAL AFFAIRS

                   SUSAN M. COLLINS, Maine, Chairman
TED STEVENS, Alaska                  JOSEPH I. LIEBERMAN, Connecticut
GEORGE V. VOINOVICH, Ohio            CARL LEVIN, Michigan
NORM COLEMAN, Minnesota              DANIEL K. AKAKA, Hawaii
TOM COBURN, Oklahoma                 THOMAS R. CARPER, Delaware
LINCOLN D. CHAFEE, Rhode Island      MARK DAYTON, Minnesota
ROBERT F. BENNETT, Utah              FRANK LAUTENBERG, New Jersey
PETE V. DOMENICI, New Mexico         MARK PRYOR, Arkansas
JOHN W. WARNER, Virginia

           Michael D. Bopp, Staff Director and Chief Counsel
                        Allison J. Boyd, Counsel
      Joyce A. Rechtschaffen, Minority Staff Director and Counsel
                   Holly A. Idelson, Minority Counsel
                      Trina D. Tyrer, Chief Clerk


                            C O N T E N T S

                                 ------                                
Opening statements:
                                                                   Page
    Senator Collins..............................................     1
    Senator Lieberman............................................     3
    Senator Chafee...............................................    15
    Senator Carper...............................................    16
    Senator Lautenberg...........................................    19
    Senator Akaka................................................    23
Prepared statements:
    Senator Voinovich............................................    33
    Senator Coleman..............................................    34

                               WITNESSES
                        Wednesday, June 15, 2005

Robert B. Stephan, Acting Under Secretary for Information 
  Analysis and Infrastructure Protection, U.S. Department of 
  Homeland Security..............................................     5
Thomas P. Dunne, Deputy Assistant Administrator, Office of Solid 
  Waste and Emergency Response, U.S. Environmental Protection 
  Agency.........................................................     8

                     Alphabetical List of Witnesses

Dunne, Thomas P.:
    Testimony....................................................     8
    Prepared statement...........................................    44
Stephan, Robert B.:
    Testimony....................................................     5
    Prepared statement...........................................    35

                                APPENDIX

Questions and responses for the Record from:
    Mr. Stephan..................................................    49
    Mr. Dunne....................................................    58


 IS THE FEDERAL GOVERNMENT DOING ENOUGH TO SECURE CHEMICAL FACILITIES 
                     AND IS MORE AUTHORITY NEEDED?

                              ----------                              


                        WEDNESDAY, JUNE 15, 2005

                                       U.S. Senate,
                           Committee on Homeland Security  
                                  and Governmental Affairs,
                                                    Washington, DC.
    The Committee met, pursuant to notice, at 10:24 a.m., in 
room 562, Dirksen Senate Office Building, Hon. Susan M. 
Collins, Chairman of the Committee, presiding.
    Present: Senators Collins, Chafee, Lieberman, Akaka, 
Carper, Lautenberg, and Pryor.

             OPENING STATEMENT OF CHAIRMAN COLLINS

    Chairman Collins. The Committee will come to order.
    Good morning. First, let me apologize for the late start of 
the hearing this morning. We had a vote on the Senate floor, 
and it seemed to make more sense to vote first; rather than 
start the hearing and immediately have to recess it. So I 
appreciate your indulgence.
    Today the Committee is holding its second hearing on the 
security of our Nation's chemical industry against terrorist 
attack. Our first hearing, on April 27, examined the chemical 
sector's vulnerability to terrorism. Today we will seek answers 
to the central questions that hearing raised: What has been 
done to secure these vital facilities? What remains to be done? 
And is Federal legislation needed?
    We will hear from our distinguished panel of witnesses that 
Federal legislation is indeed needed to give the Department of 
Homeland Security the authority it needs to improve the 
security of chemical sites.
    The clear statement from the Administration that it 
supports new legislation and will work with this Committee to 
draft a bill is a welcome and appreciated development. While I 
had hoped for more detail on what specific authority the 
Administration believes is needed, the acknowledgement that 
current laws are inadequate is a positive first step.
    In the case of chemical security legislation, the devil 
truly will be in the details. In September 2003, and again in 
March 2004, President Bush stated his support for legislation 
that establishes ``uniform standards'' for the security of 
chemical facilities. Yet, a bipartisan legislative approach 
backed by the Administration has not emerged.
    There have been previous efforts. Former EPA Administrator 
Christine Todd Whitman worked with Tom Ridge, then-Director of 
the White House Office of Homeland Security, to develop 
legislation that would have given the EPA authority to regulate 
chemical plant security. According to Governor Whitman, 
however, the legislation was killed by a combination of 
congressional opposition and tepid Administration support.
    In the previous Congress, despite the efforts of Senators 
Inhofe and Corzine, a consensus was not reached on a chemical 
security bill. But this issue is simply too important to give 
in to gridlock and to accept inaction. We need to work 
together, and we need to eliminate the stumbling blocks that 
have tripped up legislative efforts in the past.
    The stakes are high. As we learned at our first hearing, 
the EPA has catalogued some 15,000 facilities in the United 
States that manufacture, store, or use hazardous chemicals for 
productive, legitimate purposes in amounts that could cause 
extensive harm if turned against us as weapons. The Department 
of Homeland Security uses a different methodology, but still 
has identified some 3,400 facilities that could affect more 
than a thousand people if attacked.
    Only a fraction of our Nation's chemical facilities are 
regulated for security by the Federal Government, or subscribe 
to voluntary industry security standards.
    The potential for a catastrophe is not merely theoretical. 
This Committee is cognizant of the 1984 tragedy in Bhopal, 
India, where more than 3,000 people died after an accidental 
release at a pesticide plant, and thousands of others suffered 
injury.
    And just a year ago, in Dalton, Georgia, a reactor 
overheated and released a plume of toxic vapor. This accident 
sent 150 people to the hospital. Carolyn Merritt, the Chairman 
of the U.S. Chemical Safety and Hazard Investigation Board, 
testified before this Committee and described this incident as 
the poster child of our chemical vulnerability. In January of 
this year, a derailed train car in South Carolina released 
chlorine gas, a common chemical used throughout industry. Ten 
people were killed by these toxic fumes, and 250 were injured.
    Nor is the potential for terrorists to instigate a chemical 
catastrophe merely theoretical. As Steven Flynn of the Council 
of Foreign Relations told this Committee at our first hearing, 
the chemical industry is at ``the top of the list'' of al Qaeda 
and other terrorist groups. The chemical industry, testified 
Commander Flynn, ``absolutely screams at you as essentially a 
weapon of mass destruction.''
    In describing the risks associated with attacks on chemical 
facilities, we often hear the phrases ``time bombs'' and 
``Achilles' heel.'' At first glance, these metaphors seem apt. 
In truth, however, they miss the mark. Time bombs succeed in 
their deadly work because they are hidden; the intended victims 
do not know of their existence until it is too late. These 
chemical facilities are not hidden. We know they exist. We know 
precisely where they are, and what they contain. And so do the 
terrorists.
    Preparing for a potential attack on a chemical facility is 
primarily about prevention; but it is also about response. I 
look forward to the testimony we will hear today from the EPA 
witness on the Agency's role as coordinator of response to 
chemical releases, whether accidental or intentional, at most 
chemical facilities. We will also hear from the Department of 
Homeland Security about investigations of chemical sites and 
other actions that it is taking to strengthen security.
    I have quoted two witnesses from the Committee's first 
hearing to remind us of the threat of a terrorist attack on our 
chemical infrastructure, and also of the deaths that have 
resulted from accidental releases. A statement by a third 
witness reminds us of why this Committee must act.
    Richard Falkenrath, the former Deputy Assistant to the 
President for Homeland Security, called the failure to regulate 
the security of facilities ``a major disappointment.'' He 
testified further that, ``To date, the Federal Government has 
made no material reduction in the inherent vulnerability of 
hazardous chemical targets within the United States.''
    It is time to reduce the vulnerability of our Nation's 
chemical facilities to terrorist attack. And it is time for us 
to work together with the Administration, with industry and 
environmental groups and other interested parties, to draft a 
bipartisan bill.
    Senator Lieberman.

             OPENING STATEMENT OF SENATOR LIEBERMAN

    Senator Lieberman. Madam Chairman, thank you very much for 
calling this second in a series of hearings on the security of 
our Nation's chemical plants. With thousands of facilities 
scattered throughout our 50 States, chemical security is a key 
component of our overall homeland defense.
    We have been told in no uncertain terms by independent 
observers that not nearly enough has been done to address this 
danger. The experts have told us that the consequences of an 
attack on one of these chemical facilities could well dwarf the 
horror we witnessed and experienced on September 11, 2001.
    Madam Chairman, your willingness to take on this problem, 
this deficiency in our homeland defense, is a real act of 
public service. And I am confident that together we will bring 
forth legislation this year that will diminish greatly our 
vulnerabilities in this particular area.
    We have been warned of the dangers of a chemical 
catastrophe over and over again; and yet we are still at a 
great distance from putting anything approaching a meaningful 
chemical facility security apparatus in place.
    The Department of Homeland Security has launched a number 
of voluntary security initiatives with the chemical industry. 
But the GAO, the Government Accountability Office, says that 
these programs are still in their infancy. And others have 
questioned the likelihood that voluntary programs are enough to 
protect our security.
    Allow me to quote Richard Falkenrath again. He said 
earlier, ``It is a fallacy to think that profit-maximizing 
corporations engaged in a trade as inherently dangerous as the 
manufacture and shipment of chemicals will ever voluntarily 
provide a level of security that is appropriate, given the 
larger external risk to society as a whole.''
    As representatives of that larger society which faces that 
larger risk, we in the Federal Government, I believe, have a 
responsibility to act. Thus far, from the Administration, 
unfortunately, we have seen inaction and indecision.
    In October 2002, as you referenced, then-EPA Administrator 
Whitman and soon-to-be-Homeland Security Secretary Ridge 
promised to work with Congress on legislation, saying that 
voluntary measures alone were insufficient to provide the level 
of security that the American people deserve. Almost 3 years 
later, nothing really has happened. The existing approach 
continues to be what it was then.
    Now, this morning, we will hear an announcement from the 
Department that is encouraging; which is to say that the 
Department today, under Secretary Chertoff, has essentially 
come to the same conclusion that Ms. Whitman and Secretary 
Ridge did earlier, and that is that voluntary measures are not 
enough.
    But I want to appeal to the representatives of the 
Department of Homeland Security and the Environmental 
Protection Agency that are here today, to not let this 
commitment go the way of the good intentions expressed more 
than 2 years ago--2\1/2\, nearly 3 years ago--by Administrator 
Whitman and Secretary Ridge.
    I appeal to you, as soon as possible, with a real sense of 
urgency, to come forward with specifics about the kind of 
regulatory and protective system that you feel the country 
needs. I think you will find in Senator Collins and me and 
Members of this Committee a willingness to work with the 
Administration in a genuinely bipartisan way, because this is a 
critical national security, and homeland security threat.
    I look forward to your testimony, and I look forward to 
working with you to diminishing the present and clear danger 
that faces the American people from an attack or an accident at 
a chemical facility, as quickly as we possibly can. Thank you.
    Chairman Collins. Thank you, Senator Lieberman.
    I would now like to welcome our panel of witnesses. Our 
first witness is Colonel Robert B. Stephan. He has perhaps the 
longest title of any witness who has come before this 
Committee. He is the Acting Under Secretary for Information 
Analysis and Infrastructure Protection at the Department of 
Homeland Security, and the Assistant Secretary for 
Infrastructure Protection.
    So assuming that I got that right, we do welcome you.
    He also served in the Air Force for 24 years, and he has 
been the Senior Director for Critical Infrastructure Protection 
at the Executive Office of the President. And we very much 
appreciate your being here.
    Our next witness after the Colonel will be Thomas P. Dunne, 
who is the Deputy Assistant Administrator for the Office of 
Solid Waste and Emergency Response at the EPA. Previously, he 
held several senior level positions at the EPA.
    We are very pleased that both of you could join us here 
today. Colonel Stephan, we are going to start with you.

 TESTIMONY OF ROBERT B. STEPHAN,\1\ ACTING UNDER SECRETARY FOR 
   INFORMATION ANALYSIS AND INFRASTRUCTURE PROTECTION, U.S. 
                DEPARTMENT OF HOMELAND SECURITY

    Mr. Stephan. Madam Chairman, thank you for acknowledging my 
many titles. I also have to admit that I must exercise multiple 
personalities with those titles in order to get the job done 
here at the Department.
---------------------------------------------------------------------------
    \1\ The prepared statement of Mr. Stephan appears in the Appendix 
on page 35.
---------------------------------------------------------------------------
    But good morning Madam Chairman, Senator Lieberman, and 
distinguished Members of the Committee. It is absolutely my 
privilege to come before you today to discuss the Department of 
Homeland Security's efforts, in partnership with many other 
stakeholders across the country, to reduce the risk posed to 
the chemical sector--a vitally important sector in our 
criteria--from potential terrorist attack; as well as to give 
you some idea of the road ahead regarding the security of this 
critical infrastructure sector.
    I think I need to begin by saying that, first and foremost, 
it is very high priority for the Department of Homeland 
Security to reduce the risk from terrorism by implementing 
collaborative security strategies with Federal, State, local, 
and private-sector partners, to adequately protect the Nation's 
chemical infrastructure from terrorist attack.
    My discussion with you today will include a focus on the 
risk landscape associated with this chemical sector and the 
important collaborative steps that have been taken to close 
security gaps under the existing voluntary public/private 
sector partnership; but also to note, very importantly, that 
considerable progress has been made through these voluntary 
efforts. But just as importantly, further progress is required 
to close remaining important security gaps.
    As a part of Secretary Chertoff's Second Stage Review of 
DHS policies, operations, and structures, he tasked my team to 
review the current state of security and ensure that we have 
the proper tools to address the threats that face the chemical 
industry both now and in the future. To that end, we are 
currently assessing the need for a carefully measured, risk-
based regulatory regime for this sector.
    To close the existing gaps and reduce risk across the 
chemical business, the Federal Government should adhere to 
certain core principles regarding any proposed regulatory 
structure. First, we must recognize that not all facilities 
within this sector present the same level of risk, and that the 
most scrutiny should absolutely be focused on those facilities 
that, if attacked, could endanger the greatest number of 
American lives, have the greatest impact on the American 
economy, or present other significant risks.
    Second, facility security should be based on reasonable, 
clear, equitable, and measurable performance standards. A 
regulatory framework should include enforceable performance 
standards based on the types and severity of the potential risk 
posed by the terrorists. Facilities should have the flexibility 
to select among appropriate, site-specific security measures 
that will effectively address those risks.
    Third, we should recognize the progress that many 
responsible companies in this industry have made to date. Many 
companies have made significant capital investments in security 
since the September 11 attacks, and we should build upon that 
progress collaboratively in constructing delicately the road 
ahead.
    What is the threat to the chemical sector? The chemical 
sector, just like all other critical infrastructure that we are 
concerned about, is a potential target for terrorist attack. 
While we, at this time, have no specific credible information 
indicating an immediate threat to the chemical sector, the 
Department remains concerned about the potential public health 
and economic consequences should a successful attack take 
place.
    The chemical sector consists of widely varied and 
distributed facilities. It presents a comprehensive, sweeping 
challenge to us. The particular vulnerability of any specific 
facility within this overall landscape obviously depends on the 
type and quantity of chemicals onboard a site, the physical 
layout and location of sensitive target sets within a site, 
access points, geographic location, and many other variables. 
Therefore, each facility must have a risk assessment and a 
security plan that is tailored to its unique security 
environment and considerations.
    In December 2003, President Bush issue Homeland Security 
Presidential Directive 7, which assigned DHS overall 
responsibility for coordinating the national effort to ensure 
the protection and security of America's critical 
infrastructures and key resources in 17 different categories.
    Additionally, this document requires DHS to develop a 
sector-specific plan for the chemical sector, and to work with 
public and private sector partners across the board to 
implement the necessary protective measures aimed at reducing 
the vulnerabilities inherent in this sector.
    In line with the President's guidance, a large number of 
security visits have been completed by DHS, the Coast Guard, 
and the Infrastructure Protective Division, and protective 
measures are being implemented for the highest-risk chemical 
sites in the United States. The Department continues to visit 
other chemical facilities on a priority basis in coordination 
with various State homeland security advisors, emergency 
management officials, State and local law enforcement 
officials, and actual individual site owners and operators.
    DHS and the chemical sector also continue to build a strong 
partnership based on information sharing and active 
collaboration. I am pleased to report to you that these efforts 
have yielded a very solid information-sharing backbone and 
network, as well as a comprehensive approach to assessing risk 
for the sector.
    It is also important to identify the work that the chemical 
sector itself has done to date, in a close partnership with 
DHS, to take care of its security responsibilities. The owners 
and operators across the chemical sector to a large degree are 
voluntarily undertaking a variety of important security 
initiatives.
    In 2002, the American Chemistry Council developed the 
Responsible Care Security Code to help chemical companies 
achieve improvement across the board in security performance 
through a focused approach based on identifying, assessing, and 
addressing vulnerabilities; preventing or mitigating incidents; 
enhancing training and response activities and capabilities; 
and maintaining and improving relationships with key Federal, 
State, and local governmental partners.
    A component of this Responsible Care Security Code is the 
requirement for an independent third-party verification of the 
security enhancements, as well as the competent completion of 
the site vulnerability assessments that they are tasked to do 
under this code. The ACC estimates that its members have spent 
over $2 billion in securing various sites across the industry, 
in terms of their membership, since the September 11 attacks.
    Closing the gaps, and the path forward. At DHS, a major 
focus of the past 2 years has been developing tools for 
assessing risks and working cooperatively with local 
jurisdictions and companies themselves to implement appropriate 
protective measures. As we further assess the status of the 
chemical sector's largely voluntary security regime, we have 
also been evaluating whether or not the current scope and level 
of effort will be sufficient to address important remaining 
gaps and emerging threats.
    In short, while most companies have been eager to cooperate 
with the Department, it has become clear that the entirely 
voluntary efforts of these companies alone will not 
sufficiently address security for the entire chemical sector.
    Based upon work done to date, however, we now have much 
greater clarity regarding the tasks ahead, tested tools, and a 
considerable knowledge base that will help us make informed 
decisions as we go about closing these remaining serious 
security gaps.
    By exploring all available means to enhance the existing 
voluntary system, we want to ensure that all facilities have in 
place a core base of preparedness; that those facilities that 
pose the greatest risk are receiving more focused attention; 
and that the Nation's approach to the chemical sector's 
security problem will be based on reasonable, clear, equitable, 
and enforceable and measurable performance standards that 
reflect the diversity of the chemical sector as well as the 
responsible security investments that have been made across the 
industry to date.
    Since September 2001, the Administration has worked in 
partnership with numerous stakeholders to enhance the overall 
security of this vitally important sector. Through a 
combination of governance structures, information-sharing 
mechanisms, risk assessment and risk-based planning approaches, 
programmatic initiatives, local law enforcement enhancements, 
voluntary industry efforts, the chemical sector has 
demonstrated considerable progress in bolstering its security 
posture.
    But further progress is required, is needed. By developing 
a comprehensive risk-based approach for the chemical sector, we 
expect to be able to obtain more closures in a significant way 
to close remaining gaps in this vitally important area.
    This concludes my prepared remarks. I would be happy to 
answer any questions at your time, or defer to you, Madam 
Chairman.
    Chairman Collins. Thank you. Mr. Dunne.

       TESTIMONY OF THOMAS P. DUNNE,\1\ DEPUTY ASSISTANT 
 ADMINISTRATOR, OFFICE OF SOLID WASTE AND EMERGENCY RESPONSE, 
              U.S. ENVIRONMENTAL PROTECTION AGENCY

    Mr. Dunne. Thank you, Madam Chairman and Members of the 
Committee. My name is Thomas Dunne, and I am the Deputy 
Assistant Administrator for EPA's Office of Solid Waste and 
Emergency Response.
---------------------------------------------------------------------------
    \1\ The prepared statement of Mr. Dunne appears in the Appendix on 
page 44.
---------------------------------------------------------------------------
    I am pleased to appear today to discuss aspects of EPA's 
Emergency Response Program and, in particular, the chemical 
site security issues. I will summarize my written statement, 
but I ask that my entire written statement be submitted for the 
record.
    Chairman Collins. Without objection.
    Mr. Dunne. EPA's Emergency Response Program conducts 
emergency clean-up actions at oil and chemical spills and 
hazardous waste sites, and is involved with preparing and 
planning for chemical emergencies, working with a network of 
State and local emergency planning organizations.
    EPA's response can cover a wide range of emergencies, 
including the World Trade Center in New York City, Capitol Hill 
anthrax and Ricin clean-ups, and helping to manage a multi-
State effort to recover debris from the space shuttle Columbia 
disaster.
    In addition to our emergency support functions, EPA has 
partnered with the Department of Homeland Security and other 
Federal agencies to develop and implement the National Response 
Plan, the National Incident Management System, and the National 
Infrastructure Protection Plan.
    EPA is also responsible for the development and 
implementation of Federal regulations for reporting under the 
Emergency Planning and Community Right To Know Act, the 
emergency release reporting requirements under the 
Comprehensive Environmental Response Compensation and Liability 
Act, the oil spill prevention response planning requirements 
under the Oil Pollution Act, and chemical accident prevention 
and mitigation under the Clean Air Act.
    In response to the terrible consequences of the Bhopal, 
India chemical disaster in 1984, Congress established chemical 
accident prevention programs by enacting the Emergency Planning 
and Community Right To Know Act, and Section 112(r) of the 
Clean Air Act. EPCRA requires States to create State emergency 
response commissions, known as SERCs, and requires local 
communities to form local emergency planning committees, called 
LEPCs, that would prepare local emergency response plans for 
chemical accidents.
    EPCRA has also required chemical facilities to provide 
LEPCs with the information needed for emergency planning, and 
to submit annual chemical inventory reports to SERCs, LEPCs, 
and local fire departments. EPCRA does not require facilities 
to take actions to prevent chemical accidents.
    Section 112(r) of the Clean Air Act required stationary 
facilities that handle extremely hazardous materials to prevent 
and mitigate accidental releases into the air. It also required 
EPA to develop risk-management requirements for the subset of 
chemical facilities that had large quantities of the most 
dangerous chemicals.
    EPA subsequently required certain chemical facilities to 
conduct hazard assessments; develop and implement accident 
prevention and response programs; analyze the consequences of 
worst-case and alternative release scenarios; and provide a 
report called the ``Risk Management Plan,'' or also, RMPs. 
Approximately 15,000 facilities are subject to these RMP 
requirements.
    Following the September 11 terrorist attacks, one of the 
actions taken by the President was to assign EPA with chemical 
and drinking water security responsibilities. EPA considered 
using its authorities under Section 112(r) to require 
facilities that handle extremely hazardous substances to secure 
them against terrorist attack. However, EPA concluded that 
using the Clean Air Act Section 112(r) and its language 
regarding accidental releases to require facilities to take 
additional security measures for a terrorist attack would 
subject the agency to a significant legal vulnerability and 
result in protracted litigation.
    As a practical matter, the issue was overtaken by the 
creation of the Department of Homeland Security. After the 
creation of the Department, Homeland Security Presidential 
Directive 7 made the Department the lead for the chemical and 
hazardous material sector concerning infrastructure protection 
issues.
    The Department is the lead Federal agency for chemical 
security, and EPA serves in a supporting role by providing 
information and analytical support as needed.
    That completes my statement, Madam Chairman. I would be 
pleased to answer any questions that you or the Committee may 
have.
    Chairman Collins. Thank you very much, Mr. Dunne.
    Colonel, of the 17 critical infrastructure and key resource 
sectors that the Department is focusing on, where does chemical 
security, the security of chemical sites, rank in the 
Department's priorities?
    Mr. Stephan. Well, Senator, according to HSPD-7, the 
President's guidelines are very clear. They push us towards a 
focus on those sectors, first and foremost, that may be through 
a terrorist attack used as weapons of mass destruction or 
produce mass effects against American citizens and the economy. 
In terms of those guidelines, we clearly feel that the chemical 
sector is right up there as one of the top priority sectors of 
the 17.
    Chairman Collins. I know that the Department, along with 
the EPA, has visited many of these chemical facilities, done 
inspections, and made recommendations for security 
improvements. But, at our first hearing on this issue, the GAO 
testified that, despite the potentially catastrophic damage 
that could be inflicted by an attack on a chemical site, a 
comprehensive security assessment of these facilities has not 
been completed yet.
    GAO testified that, ``While DHS and EPA have visited a 
number of facilities to discuss security, the results of these 
visits are at this point unclear.'' Could you share with us 
some of your general findings as a result of these site visits?
    Mr. Stephan. Yes, ma'am. Just to clarify some of the 
numbers that are important to consider here, as you correctly 
pointed out, we consider among the top tier of chemical 
facilities across the United States, using EPA metrics that my 
colleague, Tom, could probably go into in a little greater 
detail--there are about 3,400 things that we consider high-
risk, with the respect to the ability to impact a thousand 
people or greater.
    Within that, we also have several upper-echelon tiers 
gradated so that we have a category between 10,000 and 50,000; 
50,000 to 500,000; and then, above 500,000. Of the top two 
tiers, the DHS will have visited, between the Infrastructure 
Protection Division and the Coast Guard, every single one of 
the top tier sites.
    Chairman Collins. And how many facilities are in the top 
tiers?
    Mr. Stephan. Two hundred and seventy-two, ma'am. And each 
of those sites is developing and required to turn in to the 
Department of Homeland Security IP Division buffer zone 
protection plans, which are very sophisticated, law-
enforcement-produced--State and local law-enforcement-produced, 
under the supervision of the homeland security advisors for the 
States--detailed plans in terms of how the law enforcement--
what response law enforcement would take; capabilities that 
need to be addressed, both in terms of information 
connectivity, information sharing, actual response, personal 
protective gear for law enforcement folks. That kind of 
information is due to us in a comprehensive set of plans by 
September 30 of this year.
    In addition to that category of planning, the Department 
has made site visits to what we consider to be about three 
dozen or so of the most high-risk top-tier facilities; actual 
inside-the-fence vulnerability assessments, in partnership and 
at the invitation of the facility owners and operators. And the 
degree of cooperation that we have seen during those particular 
visits has been very good.
    We have seen various instances, evidence of the $2 billion-
plus that I mentioned in my formal testimony being spent in 
terms of improved physical enhancements across the sector; 
improved cyber enhancements in terms of security across the 
sector; additional staffing; linkages in terms of information 
networks, both with us and with State and local law 
enforcement, that would provide the bulk of the reinforced 
response in the event of a terrorist attack.
    We have seen guidelines, the Responsible Care Code, as I 
mentioned during my testimony. For the members of the chemical 
sector that participate in that code, there I think have been 
very legitimate, very real, and very qualitative improvements 
in security across the board.
    But again, there is a certain percentage of the sector--I 
want to estimate, based on input from my folks and as a result 
of these visits, in coordination with ACC and other major 
associations, roughly 20 percent or so of the capacity--that we 
would be concerned about in terms of risk, that is unaccounted 
for under the Responsible Care Code. And therefore, I cannot 
come to the President or to you with a straight face and say, 
``Ma'am, I absolutely know what is going on there. I am 
comfortable with it 100 percent.''
    Some of them do let us in. Some of them let us take a 
lengthier look than others. But again, once you get beyond the 
Responsible Care Code, there are really no good metrics, solid 
metrics. About 20 percent of things that we consider very 
important that I just cannot report on favorably, one way or 
the other, to you.
    Chairman Collins. And that is one reason that the 
Administration is supporting legislation, so you will have the 
authority to require a vulnerability assessment of every high-
risk chemical site? Is that correct?
    Mr. Stephan. What we would like to do, in any kind of 
regulatory framework that we would envision that security 
focus--there are certain general principles that would have to 
be brought to the table and considered; a credible, competent, 
credited risk assessment approach, with a risk assessment 
methodology that has been accepted in some way, shape, or form.
    We have to have security planning, using a risk-based 
approach, based upon those vulnerability assessments or risk 
assessments. We would have to have implementing measures put in 
place that are risk-based, that reflect the risks and the 
vulnerabilities that come about during the assessment process. 
We would have to have some ability to audit those activities, 
and some general mechanism to ensure compliance with everything 
that I said.
    A lot of these elements have been in various legislative 
proposals that you and others have seen over the past couple of 
years. And that basic framework remains the framework that 
needs to be answered and brought to the table, I think, in any 
kind of proposed regulatory structure.
    Chairman Collins. Thank you.
    Mr. Dunne, I am trying to understand how we go from the 
EPA's listing of some 15,000 chemical sites that either store, 
use, or manufacture high-risk hazardous chemicals, to DHS's 
list of 3,400 chemical sites that are high-risk.
    The EPA, for example, has estimated that there are 123 
facilities that, if there was a release, could affect a million 
or more people. I realize we are not talking about casualties 
necessarily here, but an effect on a million or more people. 
DHS seems to have a far more conservative estimate, and comes 
up with some 300 facilities that could affect a population of 
greater than 50,000 people.
    I am trying to understand what the scope is here, and how 
we go from 15,000 facilities on the EPA's list to 3,400 
facilities on DHS's list. I would like you to start, and then I 
will ask you, Colonel, to comment.
    Mr. Dunne. Well, the 15,000 facilities come about because 
the legislation calls for the amount, quantity of facilities, 
and the types of chemicals that are used or stored there. There 
are 140 different chemicals. And then we gauge in terms of what 
quantity represents a potential problem. And it turns out it is 
15,000.
    When we went out with the original regulations in 1999, it 
was 15,000. We have had a couple thousand go off the list, and 
a couple thousand come on. So the number has not really 
changed.
    The point of the 123 facilities, I have read the statement 
and I have read news reports about that. And it is generally 
overstated, in terms of what the concern is. Of those 123 
facilities, there are a million people in the surrounding 
areas. So if you took the facilities as a point, a central 
point, and you reached out and drew a radius around it, there 
would be a million people that, depending upon circumstances, 
could be affected. It certainly does not mean anything in terms 
of fatalities or casualties.
    The fact is that I believe DHS--and I will let Bob speak 
more directly to it--took a look at analyzing, and that seems 
to me a very reasonable approach, in terms that we do know that 
wind blows in one way; you have atmospheric circumstances that 
override that. A million people are not going to be affected in 
any one place.
    Now, the closer you are to a facility, depending upon the 
release and the type of chemical, it could create problems. So 
actually, the 123 is now 110 in the most recent count that our 
staff did on it. And I do not think it is a drop-off, in terms 
of their logic. Because it seems to me that what they did is 
focus on what are the targets that would be of most serious 
concern, and honing in on those at the beginning, and then 
working your way down the list.
    Chairman Collins. Thank you. Colonel, I will come back to 
you, since my time has expired, in the second round.
    Senator Lieberman.
    Senator Lieberman. Thanks, Madam Chairman. It seems to me 
that the big question that has been decided but not acted upon 
is whether voluntary measures by the chemical industry are 
enough in the face of the threat posed here that everyone 
agrees on. And the answer, I believe we will all come to, is 
that voluntary measures are not enough.
    I appreciate and admire the voluntary measures that have 
been taken by the industry, but I think when you set the 
reality against the enormous threat from either a terrorist 
attack or an accident, the Federal Government has to speak for 
the national security, the homeland security, and the public 
safety, and ask more.
    And I gather from your statement today--I conclude from 
your statement today that the Administration has reached that 
conclusion. I quote from, Colonel Stephan, your printed 
testimony before the Committee today, ``I can report on his 
behalf that Secretary Chertoff has concluded that, from the 
regulatory perspective, the existing patchwork of authorities 
does not permit us to regulate the industry effectively.''
    To some extent, that mirrors the conclusion that 
Administrator Whitman and Secretary Ridge articulated about 
2\1/2\ years ago. So let me begin with a general question; 
which is that the cynics or the skeptics would say, well, how 
is this any different, the announcement that you are making 
this morning on Secretary Chertoff's behalf, than the statement 
that Administrator Whitman and Secretary Ridge made 2\1/2\ 
years ago, which has produced nothing--I mean, nothing 
regulatory--since then?
    Mr. Stephan. Sir, thank you for that assessment. I think I 
want to make one clear point; that this is not a change in Bush 
Administration policy, in terms of going back as far as the 
President's physical critical infrastructure protection 
strategy that was released in February 2003.
    Basically, he has stated clearly our willingness to work 
with Members of Congress on this issue because it was, even 
back in those days, beginning to be apparent that voluntary 
efforts alone and voluntary codes were not necessarily going to 
get us to the end state across the sector that we would be 
comfortable with.
    And the Administration has participated in numerous efforts 
and aspects of a dialogue with both houses of Congress over the 
past couple of years, to try to figure out what the appropriate 
solution might be.
    I think there are two key and very distinct differences 
that I am bringing to the table for you today. Before I get to 
that, though, the new team is onboard. Secretary Chertoff 
assumed his responsibilities back in February. I assumed these 
current responsibilities about 7 weeks ago. Secretary Chertoff 
asked me to take a look, under his second stage review, at this 
chemical security issue, as well as the infrastructure 
protection mission area at large; but drilling down within that 
the things that we think are absolutely the most important and 
significant, need to be accelerated in terms of our approach.
    Having said that, basically agreeing with the conclusion 
that has been on the table for the past couple of years, two 
new dynamics. We now have a very clear understanding, I think, 
of where the voluntary security regime that has been in vogue 
for the last 3 years has taken us. The extent that we are going 
to be able to get the effects we are looking for out of that 
voluntary regime is now fairly clear.
    That regime was just coming on the table, in terms of the 
private sector roll-out of that Responsible Care Code that I 
discussed, 2 years ago. So now we clearly understand, working 
in partnership with industry, the extent to where that is going 
to take us on the security spectrum.
    Added to that is 2 years ago, to come to you all with a 
reasonable approach was not as possible as it is today, in 
terms of risk management. We did not have the risk assessment 
tools--the science. The technology was just not there 2 years 
ago.
    I am happy to report that, in partnership, in full 
collaboration with the chemical sector across the board, we 
have been working diligently for the past year or so to develop 
an acceptable, measurable, risk-based formula that brings 
together consequences, vulnerability, and threat into a tool 
that is Web-based, and that we are now finished and ready to 
deploy uniformly across the chemical sector.
    So because of the technology, building upon the baseline of 
the voluntary efforts that have been put into practice up to 
this point, we can come back to you, I think, with a much more 
measurable, sophisticated approach, other than some kind of 
blanket authority to do lots of things across the sector that 
may or may not be relevant based on a risk metric.
    Senator Lieberman. I hear you, and I appreciate that. And 
so you have got a better risk-based analysis now, which would 
be the basis for legislation. And you have lived for some 
period of time under the voluntary system. You know what it can 
do and what it can not do.
    Mr. Stephan. Correct.
    Senator Lieberman. What are the major shortcomings of the 
voluntary system, would you say? What is not being done that we 
would want to do legislatively and by regulatory system?
    Mr. Stephan. Yes, sir, I think basically two answers to 
that question. For the operational capacity that we believe to 
be high-risk, around 20 percent of the overall sector that is 
not participating in any kind of measurable voluntary code, 
that would allow us to get to that part of the problem and 
tighten down the loop in terms of that.
    Senator Lieberman. Let me make sure I understand that. You 
are saying, based on the risk analysis you are able to do now, 
that 20 percent of those facilities that you would consider to 
be high-risk have not assumed on a voluntary basis their 
responsibility?
    Mr. Stephan. We believe that about 20 percent of the 
operational capacity, in terms of output of the chemical 
sector, is not governed by any kind of voluntary practice or 
voluntary security code.
    Senator Lieberman. Is that 20 percent of those you consider 
high-risk, or 20 percent of the overall community that is 
chemical?
    Mr. Stephan. That is 20 percent of the overall capacity 
that we would consider to be high-risk.
    Senator Lieberman. Got it. I am sorry, go ahead.
    Mr. Stephan. Yes, sir. So that would attempt to close the 
gaps on that end of the spectrum.
    The other piece that we really want to get to is the pieces 
of industry that have very responsibly been making some very 
significant investments and enhancements over the past couple 
of years. We want a way to make sure that we can measure those, 
using risk-based metrics and criteria, to ensure that those 
kinds of measures that have been put in place, based upon the 
unique requirements of every individual facility that we 
consider to be at high risk, are appropriate or having a 
measurable effect that we can then take to the President, 
report progress, take to you and report progress; and to be 
able to sustain all of that momentum, very importantly, over 
time, as we move further and further beyond September 11.
    Senator Lieberman. I hear you. Let me ask this--there was 
general feeling on Capitol Hill that EPA under Administrator 
Whitman had put together a legislative proposal to go beyond 
voluntary initiatives and have some mandated security 
requirements on part of the chemical industry, but it never 
made it to the Hill.
    My question to you, and to you Colonel Stephan, as we begin 
anew, is whether what you are saying is you are prepared to 
support legislation, or work with us, that a Committee like 
ours would come up with? Or is the Administration intending to 
make a specific legislative proposal in this area?
    Mr. Dunne. Well, let me start, and then Bob can answer. In 
terms of any legislation that was developed at EPA or other 
places in the Administration, there were discussions, but there 
was nothing actually developed as such. And it was somewhat 
abandoned, as we had given consideration to see if we could use 
Section 112(r) and whether or not that was a good idea. And 
besides the lawyers bantering back and forth for a period of 
time, both within EPA and also other agency departments, it was 
decided not to go the legislative route.
    And at the same time, when we looked at Section 112(r) we 
thought, from both a legal and a policy consideration, we would 
have been bogged down in the courts in regulations and, to this 
day, we probably would not have anything out. So there was 
never a serious legislative proposal that was forthcoming that 
would have come to OMB and be transmitted to the Hill.
    Senator Lieberman. So Colonel, let me ask you the question. 
Is the Administration going to make a specific legislative 
proposal to the Committee? Or are you wanting to just work with 
Senator Collins and me and the other Members as we develop 
legislation?
    Mr. Stephan. What we would like to do, as the point I made 
earlier, is that we basically own the metrics, the tool that is 
going to allow us to take what, I think, is a reasonable, 
rational, measured, and effective approach to this. So we own 
that methodology. What we have to do is take that methodology 
in accelerated fashion and build a proposed regulatory 
framework around that methodology through the policy 
coordination processes of the Homeland Security Council.
    Having established and put some more granularity, some more 
bones on the skeleton of my testimony I delivered today, we 
would like to then work with you, based upon that knowledge 
base we have, the technology that has been pushing us over the 
last 2 years--work collaboratively with our partners in 
Congress to put the right solution on the table.
    Senator Lieberman. So if I hear you correctly, the 
Administration is not intending to send us a proposal. But you 
are saying today you want to work with us on developing a 
proposal?
    Mr. Stephan. Yes, sir, but a proposal based upon the 
regulatory principles and framework that our technology 
permits.
    Senator Lieberman. Understood. My time is up. But I do want 
to say finally that there has been some attempt to deal with 
this problem of chemical plant security in the Environment 
Committee. Unfortunately, it has been gridlocked. There, the 
focus was naturally on the environmental consequences of 
chemical security. Here, we are focused on homeland security. 
But there is an overlap, naturally.
    And I do think that--with all respect, because I am on that 
Committee, too--I think Senator Collins and I begin with a 
strong non-partisan interest, from a homeland security point of 
view, in getting something done.
    So I welcome what you have said today. And again, I look 
forward to working with you, with a real sense of urgency, to 
get something done to protect the American people as soon as 
possible. Thank you.
    Chairman Collins. Thank you. Senator Chafee.

              OPENING STATEMENT OF SENATOR CHAFEE

    Senator Chafee. Well, thank you, Madam Chairman. And as 
Senator Lieberman said, we worked on the Environment and Public 
Works Committee--Senator Lautenberg, Senator Carper, and 
Senator Corzine--all working on trying to get some compromises 
on the environmental issues. And it was difficult. I think we 
got hung up on inherent safer technologies.
    But now as we go forward I am questioning, as Senator 
Lieberman did, on the voluntary aspects, as it exists now. And 
if I understand correctly, 20 percent are not participating, 
high-risk. And is there a cost to those companies that are 
participating, the 80 percent that are participating, that give 
an unfair advantage to those that are not, Colonel?
    Mr. Stephan. Sir, I am not quite sure I understand the 
question.
    Senator Chafee. If I heard your answer correctly, 20 
percent under the voluntary scenario are not participating in 
undergoing--introducing safer measures. Do I hear that right?
    Mr. Stephan. That is correct.
    Senator Chafee. And so there must be a cost advantage to 
them. And that is my question. Those companies, the 80 percent 
that are participating, are incurring costs that the other 
companies are not incurring; and thus there is an unfair 
advantage. Does that mean we should enact legislation, 
considering that there is unfair advantage, those companies 
that are not incurring these costs?
    Mr. Stephan. OK, sir, thank you. Again, I am not an 
industry expert on this topic. And I would defer any real 
granular answer back to you to one of the industry 
associations, itself.
    But to my understanding, most of the capacity that we are 
worried about that would be high-risk that does not fall within 
the voluntary regime constitute or are represented by mid-sized 
to smaller companies that still have very considerable amounts 
of chemicals or types of chemicals onboard their sites that 
would cause us to place them in the high-risk category. 
Therefore, the profit margins there are something that are a 
very serious concern to that aspect of the industry.
    Having said that, I think that we can, with the risk 
assessment methodologies and tools that we have come up with 
now, work out some solutions that are facilities-based, as 
opposed to sector-based, that would bring down the same thing 
across the board at every single facility.
    I think we are better now. We are able to make better and 
more informed judgments. And we could adjust the security 
framework based upon risk and based upon a menu of options that 
would meet a certain criteria that these companies would be 
allowed to pick from; hopefully, some solutions are more cost 
effective than others.
    Senator Chafee. Well, once again, we worked hard on the EPW 
Committee, and look forward to working with you here to get 
some fair legislation. Thank you.
    Chairman Collins. Thank you. Senator Carper.

              OPENING STATEMENT OF SENATOR CARPER

    Senator Carper. Thanks, Madam Chairman. It is sort of 
ironic--I will follow up on what Senator Chafee was saying--
that four of the five Members that are here today are folks who 
also serve on Environment and Public Works. And we have worked 
in these vineyards a little bit earlier. And I think one of the 
reasons why most of the folks that are here today are from EPW 
is because of our familiarity with these issues and our 
interest in these issues.
    I am from Delaware; Senator Lautenberg over here, is from 
New Jersey. Chemical facilities and the products that they 
produce are important to my State and, obviously, to his. I 
understand our new Secretary, Secretary Chertoff, is actually 
from New Jersey. And I just was kind of wondering out loud--and 
you do not have to answer this question--but maybe one of the 
reasons why there is some renewed interest or some stronger 
interest in this issue, in trying to work with us to find a 
path forward, might be because--what's the old saying--all 
politics is local, and he comes from a State where these issues 
are important. And they have even more chemical plants in New 
Jersey than we do in Delaware.
    And we know that in our State an incident at a chemical 
plant can be devastating. We know that we are vulnerable to 
some extent in our State and other States, as well--probably, 
all States, if you have got 15,000 chemical plants out there; 
probably covers just about everybody. And it is important for 
us, I think, to not wait for the terrorists to show us that we 
need to do more.
    The first question I want to ask just to the two of you, 
how long have you all been working together on these issues? Is 
this a new partnership? Is this something that you all have 
been working on for a couple of years? Is this the first time 
you have met?
    Mr. Dunne. Well, we have been working together on the 
National Response Plan and National Incident Management System 
for going on 3 years. And in terms of this subject matter, Bob 
is relatively new to it, but our office has been involved in it 
for 3 years, since it was discussed at EPA back at that time.
    Mr. Stephan. That's right. We have been working together 
with the EPA since the Department's existence. And with the 
issuance of HSPD-7, they are the sector lead for the water 
sector and all things security-wise associated with the water 
sector. We have a good partnership; a partnership, a framework, 
that was nurtured in fact during our joint work on the National 
Incident Management System and the National Response Plan. So I 
think it has been a great and effective partnership. And we 
play off each other's authorities and strengths in order to 
tackle problems jointly.
    In terms of the comments that you made earlier, I just want 
to emphasize that the President has focused us, through HSPD-7, 
on the sectors that are of highest risk to the Nation in terms 
of public health and safety, economic consequences, and the 
like. And because of the chemical sector's potential to be used 
as a weapon of mass destruction or weapon of mass effects under 
certain scenarios, that is clearly specified or called out in 
the President's guidance to us.
    And in terms of Secretary Chertoff's State of residence, he 
represents very well the great State of New Jersey, but the man 
is risk-based in everything I have seen him do since he has 
taken office. And I think that is the right approach for this 
time. And I am just happy that the technology that we now have 
at our fingertips is able to basically facilitate or enable the 
furtherance of that approach.
    Senator Carper. The title of today's hearing is ``Is the 
Federal Government Doing Enough To Secure Chemical Facilities 
and Is More Authority Needed?'' And let me just ask each of 
you, just without a lot of jargon, just as plainspoken as you 
can be, just answer that question for me. I will say it again: 
Is the Federal Government Doing Enough To Secure Chemical 
Facilities and Is More Authority Needed? Just very plainspoken.
    Mr. Stephan. Yes, sir. I'll say absolutely, no one is ever 
doing enough when it comes to critical infrastructures. That is 
as plainspoken as I can get. But I will say we have made 
important advancements. And the newspaper accounts that I read 
and the pronouncements from academics and others that say we 
have done nothing is absolutely the farthest possible thing 
from the truth that I can envision, based upon going over this 
in considerable depth with my team since I assumed this 
position.
    We are working with the industry. We are doing risk 
assessments. We partner developed the methodology that is going 
to guide us both to the future; set up information-sharing 
mechanisms that work----
    Senator Carper. This is important to us. It is important to 
our States and to our country. So what I hope flows out of here 
is the opportunity for us to work with Senator Collins and 
Senator Lieberman. And we are pretty good in this Committee 
working across the aisle, and have got great leadership.
    Mr. Stephan. Yes, sir.
    Senator Carper. And we just want to be able to work with 
you. My view--and this is just the way I look at it--you all 
have a lot to say grace over, since the Department was created. 
And you must feel like a lot of days you have been drinking out 
of a fire hydrant in the last several years; probably still 
feel that way some days.
    So there is a lot for you to focus on. You now have a 
chance to focus on this. And we just want to work with you to 
get the job done and to make our communities and our chemical 
facilities safer.
    Mr. Stephan. OK.
    Senator Carper. I will go back and restate the title of the 
hearing: Is the Federal Government Doing Enough To Secure 
Chemical Facilities and Is More Authority Needed? Let's focus 
on the second half of that, ``And Is More Authority Needed?''
    Mr. Stephan. Yes, sir. Doing a lot; need to do more. And 
more authority is clearly needed.
    Senator Carper. And give us some idea what context, what 
format authority might take.
    Mr. Stephan. What we would like to do is work in 
partnership, again, with you all, to figure out what the right 
mix is for this sector, based on some key principles; that we 
use a risk-based approach to setting up this regulatory 
framework that takes individual facilities into consideration, 
so that we do not attempt to put a cookie cutter in place and 
expect that is going to do the job for us in any sense.
    We are better than we were 2 years ago. We have the 
technology to help us inform that structure. We want to make 
sure what we put in place is equitable, fair, takes into 
account responsible investments that have been made. But at the 
end of the day, it has to be effective and it has to be 
measurable.
    But it also cannot be the same. Because one important 
aspect that we all are concerned about, if we put a detailed 
reg out that says, ``Every chemical facility will approach it 
in this manner, using the following steps,'' I do not know a 
better cookbook to give to al Qaeda than that outlines exactly 
the level of security by facility across the country. We have 
to be very careful we do not do that; and allow a menu of 
options to be selected flexibly, as long as they are 
measurable, effective, and get the job done.
    Senator Carper. Mr. Dunne, do you want to jump in here?
    Mr. Dunne. Well, I would agree with Bob that authority is 
needed. But I do think the knowledge base in the last 2\1/2\ 
years has grown appreciably, much more than when we were 
thinking about the program before DHS became a reality. And I 
think they have developed tools that certainly were not at our 
disposal back when we were looking at the project at EPA. So I 
would support what he said in terms of authority.
    And coming from a regulatory agency, one of our problems 
with regulatory programs is trying to fit everything under one 
big regulation. And it is a problem. And as you know, Senator, 
our RMP plans are available to the public under community right 
to know, but there is certain information----
    Senator Carper. I'm sorry, say it again. What plans are 
available?
    Mr. Dunne. The management plans on this Clean Air Act, 
under Section 112(r). But there are also consequences, which 
only can be seen in reading rooms. And there are 50 reading 
rooms. I think we have got to be careful about how much we 
provide outside of the realm of the facility and the law 
enforcement people and the Federal Government officials. I 
think there is a real danger of having plans floating around, 
where any terrorist, or almost any amateur--it doesn't have to 
be a professional terrorist--can get their hands on 
information. So I think it has to be a thoughtful approach.
    And I would agree that coming up here at a public hearing, 
if we did have the answer, what should go in the legislation, 
ought to be really thought out in terms of what are we doing to 
protect the American public and what are we doing to make sure 
the security of the country is being held that we are not 
aiding and abetting enemies.
    Senator Carper. All right, good. My time has expired. Madam 
Chairman, thanks very much.
    Chairman Collins. Thank you. Senator Lautenberg.

             OPENIN STATEMENT OF SENATOR LAUTENBERG

    Senator Lautenberg. Thank you, Madam Chairman, for 
convening this hearing as you have. It has been too long since 
we have had the horrible experience that has shaken our resolve 
and our comfort in that we are doing whatever we should to 
protect our people from assault. And Madam Chairman, I ask 
unanimous consent that my opening statement be included in the 
record.
    Chairman Collins. Without objection.
    [The prepared statement of Senator Lautenberg follows:]
                PREPARED STATEMENT OF SENATOR LAUTENBERG
    Madam Chairman, thank you for convening this hearing on this 
critical topic.
    My concern about the security of chemical plants dates back to the 
late 1990's. It's now 2005 and time to stop talking and start acting to 
confront the terrible risks that have not diminished since September 
11.
    New Jersey has some 1,600 chemical facilities within its borders--
not one of which is now legally required to take any of the risk-
reduction steps identified by the experts in our last hearing.
    Today, I want to hear what the Department of Homeland Security has 
accomplished in the last 30 months to protect our children and our 
families.
    The GAO tells us that between 10 and 100 million Americans live in 
a vulnerable zone of potential sickness and death.
    The Congressional Research Service has calculated that more than 
8,000 schools, or hospitals, or both, are near one of the nation's 
chemical facilities.
    In the wake of September 11, we can not any longer afford to keep 
talking about these risks--it is time for action.
    The 9/11 Commission cautioned that we must not focus so much on the 
last attack that we miss the next attack to strike our country.
    I'm afraid we have failed to absorb that lesson as well as we 
should.
    And chemical plant security is one of the most glaring examples of 
that failure.
    There are about 15,000 chemical facilities in the country. More 
than half of them are located near our families, where our children and 
grandchildren live and play. More than one thousand human beings could 
be killed.
    For example, according to EPA the largest ``zone of vulnerability'' 
to wide-spread death and injury is in South Kearney, New Jersey where 
twelve million people live.
    Mr. Chairman, the attacks of September 11 were devastating. My 
State lost 700 of our friends, neighbors and loved ones that day. We 
all hope that we never see the like of it again.
    But the fact is, a terrorist attack on a chemical facility could be 
even worse.
    And by ignoring the threat, we might be inviting such an attack, 
because terrorism experts say our enemies like to focus on poorly 
secured ``soft'' targets.
    I would urge my colleagues on the Committee, who I know are very 
committed to this issue, to move forward from this hearing toward a 
legislative remedy.
    I thank all the witnesses who are with us today, and I look forward 
to hearing their views on this crucial issue.

    Senator Lautenberg. I thank you for that.
    Mr. Stephan--and I thank you both for your testimony--in 
light of the announcement this morning that we have seen in the 
paper and the news that the Bush Administration is now 
endorsing mandatory requirements for increased security at 
chemical plants, have you looked at the Corzine bill, my 
colleague's bill, in terms of what he would like to see done 
with the Chemical Hazards Board, the management of these 
facilities, to better conform to our security needs? Have you 
looked at that?
    Mr. Stephan. Sir, in developing this framework--and again, 
I want to emphasize that this is not a new approach. The policy 
has always been that we are willing to partner with Congress to 
figure out the right legislative solution to fix some gaps 
across this sector. I, personally, have not gotten in depth 
into any of the previous amendments or potential pieces of 
legislation that have come forward, being new to this. But I 
can assure you that as we take a look at working together to 
develop what is the right regulatory framework for this sector, 
that we need to consider all things that have previously been 
on the table, and measure them against the baseline criteria--
--
    Senator Lautenberg. Yes, well, not meaning to cut you 
short, but it is an important proposal, as are some others that 
are there. And I would hope that DHS would take a prompt and 
thorough look at these things, to give us their view on what we 
ought to be doing.
    Mr. Dunne, there is a significant difference between the 
figures that the EPA lists as facilities that need attention 
and DHS. EPA reports that there are 110 facilities where an 
explosion could harm a million people. And I am not sure I 
caught the nuance that you were trying to bring here.
    The focus is only perhaps on those places where a million 
people could be injured as a result of an accident or a 
terrorist attack, obviously? DHS reports that there are 300 
facilities--far larger number--where an explosion could harm 
about 50,000 people.
    Now, where do you draw the line on these data? Are we 
concerned about quantity of those at risk? Because I mean, if 
500 people were to die from a chemical attack or an accident, 
we would be up in arms about it. We would be turning loose all 
of our facilities to do something with that. What do you see is 
the explanation for the difference?
    Mr. Dunne. Well, I am not too sure we really differ. The 
123, or now 110--may be somewhat out of context. It is a 
hypothetical, analytical modeling tool that was used to develop 
that. It isn't saying, in effect, that if you happen to be one 
of a million people around a facility that you are going to be 
affected. It is potentially that. And it shouldn't be taken out 
of that context.
    I think what DHS has done, as they have gotten 
sophisticated and learned more and more about the tools is try 
to isolate those facilities that are considered the most 
vulnerable, based on what is there in terms of the quantity and 
the type of chemical, and also in terms of the surrounding area 
in terms of the population. I think there are some 
similarities, and there obviously is some overlap.
    Senator Lautenberg. But Mr. Dunne, we are dealing here with 
huge numbers of people. And whether the effect is kind of 
peripheral or whether it is lethal, I mean, we have an 
obligation to do what we can.
    I consider--and I have said this publicly many times--that 
the front in this war that we are in in Iraq extends all the 
way across America. I believe that is where the front is. And 
we do not spend anywhere near the amount of money protecting 
our citizens on American soil that we do trying to help Iraq 
correct its problems and to protect our service people over 
there.
    So I am not sure where the defining line is that says, 
``Well, this deserves attention.'' I think they all deserve 
attention. I am author of the Right-To-Know law. The Right-To-
Know law carries virtually no penalties; but it has had 
enormous conformity by private industry. And we have reduced 
toxic emissions by 40 percent across this country as a result 
of that.
    But this goes way beyond that kind of thing. And I think it 
is agreed, is it not--and I ask both you and Mr. Stephan--that 
sanctions are in order, in order to get people to conform to 
the need to alert the public to what it is that they are 
carrying, what the possibility is if there is an accident or an 
attack.
    Aren't we at a different point in time, in terms of trying 
to split hairs about whether or not 50,000 people is a 
reasonable size market to protect? Or might it be 500 people? 
The million-person number is so devastating it is almost 
unimaginable, but New Jersey has a facility identified as a 
place where 12 million people could lose their lives. But to 
any one of those families, or to someone who lost someone in 
Oklahoma, the devastation is beyond comprehension. So where do 
we go with these numbers that you have put out here?
    Mr. Dunne. I am not too sure what you mean, where we are 
going. We have 15,000 facilities and----
    Senator Lautenberg. Well, I will tell you where we are 
going. I will tell you directly where we go. There is a huge 
difference in the numbers between the two parties. I would like 
you to explain, tell me why their's is wrong. Their's says we 
have to talk about 300 facilities; and as I hear you, well, it 
is not 123, it is 110. Just explain your numbers a little more.
    Mr. Dunne. Well, I do not think that we have a different 
approach. I am not too sure our numbers are different. A 123 to 
110 is just a fact, in terms of what we receive in reports.
    Senator Lautenberg. They are saying 300.
    Mr. Dunne. Well, ours was not based on anything more than 
the population around facilities or covered under the RMP. And 
I think what they are talking about is completely different in 
terms of how you size a program up in terms of where you go 
first in terms of vulnerability that creates potentially the 
biggest problem. I do not think there is any difference, 
Senator.
    Senator Lautenberg. Help me, Colonel Stephan. Do you see 
any difference between your 300 identified facilities where an 
explosion could harm about 50,000 people, and EPA's, where they 
say there are 110 facilities where an explosion could harm a 
million people? Are we saying that 50 is a good place to start, 
or do we only look at places where a million people could be 
harmed?
    Mr. Stephan. No, sir. Well, every human life is important, 
but numbers mean different things to different people. What the 
EPA numbers mean to them is, based upon this point on the map 
that represents the geographic center of this production site, 
for example, based upon the most toxic chemical onboard that 
site at a threshold quantity, there is a ring drawn around that 
site ``X''-number of miles out from the center.
    What that 12 million figure represents, not 12 million 
deaths; 12 million people that could somehow be affected, 
depending on wind direction, wind speed, atmospheric factors 
that have to be taken into account from a safety or planning 
perspective. The State-level councils, the local-level 
councils, the emergency responder awareness, the safety issues, 
the gearage, all of that factors into that. And that is what 
they have to be concerned about.
    What I have to be concerned about is taking those baseline 
numbers that we get from the EPA--and we agree on the baseline 
numbers--and I have got to drill down further, because 12 
million people are not going to die if that one chemical plant 
is affected. We have to use a more sophisticated approach, 
based on plume modeling, wind direction, wind speed, 
atmospheric conditions, so on and so forth, to drill down on 
that aggregate number of 12 million.
    And when you do that, you get to a significantly less 
percentage of the population that would result in actual 
fatalities or be affected in some way, demonstrating visible 
signs of being affected by the chemical agent.
    So we worry about that, in terms of our risk-based metrics, 
on where to drill down, how to come up with the numbers that we 
have. They have to be more over-arching in nature, because 
everybody inside that circle--the law enforcement guys, the 
firemen, the emergency management folks--have to go through 
training awareness and be equipped so that they can respond in 
case the wind just happens to unluckily blow in their direction 
on that day.
    Senator Lautenberg. Madam Chairman, I hope the record will 
be kept open for questions, because we obviously have disparity 
here that leaves me, at least, kind of scratching my head and 
saying, ``I don't get it.'' Thank you.
    Chairman Collins. Thank you, Senator. Actually, with 
Senator Akaka's indulgence, I was going to ask Colonel Stephan 
to conclude the answer to my question, which speaks to this 
very issue. But if the Senator is on a tight time frame, then I 
will go directly to you.
    Senator Akaka. I would appreciate that.
    Chairman Collins. Go right ahead, Senator. Then we will 
come back to my question.

               OPENING STATEMENT OF SENATOR AKAKA

    Senator Akaka. Thank you very much, Madam Chairman. I thank 
you so much for holding this hearing. You all know that this 
follows the recent chemical security hearing we have had. At 
that hearing, we learned that the United States has a great 
deal of work ahead to strengthen and ensure the security of the 
chemical sector in the post-September 11 environment.
    And all the witnesses that testified, testified that the 
voluntary efforts to secure the chemical industry are 
insufficient, and so we are having this hearing. And they 
advocated at that time for more Federal regulation of the 
chemical industry.
    I would like to welcome our witnesses. I had another 
commitment, Madam Chairman, this morning, and I regret that I 
was not able to hear the witnesses' testimony. And I ask that 
my full statement be placed in the record.
    Chairman Collins. Without objection.
    [The prepared statement of Senator Akaka follows:]
                  PREPARED STATEMENT OF SENATOR AKAKA
    Madam Chairman, thank you for holding this hearing. I would like to 
add my welcome to our distinguished witnesses from the Department of 
Homeland Security (DHS) and the Environmental Protection Agency (EPA).
    At our recent chemical security hearing, we learned that the United 
States has a great deal of work ahead to strengthen and ensure the 
security of the chemical sector in the post-September 11 environment. 
All the witnesses at the last hearing testified that the current, 
voluntary efforts to secure the chemical industry are insufficient. 
They advocated for more Federal regulation of the chemical industry. 
Given the potential economic consequences and lives that could be lost 
as a result of an attack on our chemical facilities, I believe that we 
need to consider giving DHS greater authority to regulate the chemical 
industry. However, we must move forward carefully and ensure that the 
Department is given the necessary tools to undertake this new 
challenge.
    I am concerned that the proposals from the last hearing lacked 
adequate analysis of the human, financial, and organizational resources 
required to regulate an industry. Dr. Richard Falkenrath, The Brookings 
Institution, proposed that DHS be responsible for promulgating 
regulations, certifying companies, verifying the certification, 
enforcing compliance, and offering an appeals process. If this were to 
occur, how would the Department be reorganized and how many additional 
personnel would be required?
    It was suggested by Dr. Stephen Flynn, Council on Foreign 
Relations, that the Department use contractors to execute many of these 
new responsibilities. As a longstanding supporter of the Federal civil 
service, this suggestion troubles me. His proposal would contribute to 
a growing trend at DHS: More and more critical positions being 
contracted out, while the government is losing the opportunity to 
develop institutional knowledge and a cadre of skilled and dedicated 
employees. For the same reason that passenger and baggage screening was 
federalized after September 11, I question whether it is advisable to 
have contractors enforcing Federal regulations in the chemical sector.
    Furthermore, the EPA has a special expertise in the chemical sector 
from which DHS should draw upon. Some fear greater EPA involvement in 
chemical security regulation could lead to more environmental and 
safety scrutiny of the chemical industry. But I think it is wrong to 
preclude the involvement of EPA.
    For these reasons, I urge my colleagues on this Committee, many of 
whom have spent the past few years committed to building and improving 
DHS, to examine thoroughly how regulation will be implemented and what 
would be required of DHS.
    Madam Chairman, I welcome this opportunity to explore these issues 
in greater detail. I look forward to the testimony of our witnesses.

    Senator Akaka. Under Secretary Stephan, I would like to 
follow up on an issue raised by Senator Collins in her opening 
statement. At the April 27 hearing, two of the witnesses 
proposed granting DHS extensive chemical security regulatory 
authority that would include promulgating regulations, 
certifying facilities, verifying the certification, and 
enforcing compliance.
    Under Secretary Stephan, I understand that DHS has not 
specifically asked for such authority. However, if Congress 
mandates that DHS regulate chemical security in the manner I 
just described, what financial and human resources will the 
Department need? And in answering this, I ask you to be as 
specific as possible.
    Mr. Stephan. Yes, sir. Thank you for that question. I 
believe that I do not have good numbers associated with a 
sweeping, over-arching, very tightly restrictive, all-
encompassing regulatory framework. I do not have precise 
numbers for you, because that has not been our approach up to 
this point. I just know those numbers would be very 
significant.
    That is one of the reasons we are coming to Congress, to 
work in partnership, to look at assembling a regulatory 
framework that is risk-based, so that we do not have to apply 
the exact same standards across the board pertinent to every 
facility, with no other consideration.
    What we have to do is implement a regime, I think, that is 
risk-based, is measured, gets the effectiveness and the 
efficiencies that we are looking for in a measurable, 
reportable manner; that treats individual facilities based on 
risk differently, based upon a common approach; but to allow a 
menu of options based on standards that we would promulgate and 
allow the facility owners and operators different ways to get 
at that problem.
    In this kind of regime, I think we could perform the 
regulatory function without a great influx of new people, new 
government employees, if we adopt this measured approach. We 
are adopting the measured approach not because the numbers are 
bigger or smaller in terms of government employees, but we 
think it is the right approach. The right approach, 
coincidentally, I think will drive us to a smaller number of 
Federal employees as a requirement.
    Senator Akaka. Mr. Secretary, to answer my question 
specifically, I would ask you to provide us with those numbers 
that you do not have now, for the record.
    Mr. Stephan. Yes, sir. We will go back and provide you an 
answer.
    Senator Akaka. Secretary, if DHS is given regulatory 
authority over chemical security, should the regulating office 
be part of the Office of Infrastructure Protection, or 
separate? And if separate, do you think its director should be 
Senate confirmed?
    Mr. Stephan. Well, that is an interesting set of questions, 
there. So let me answer that in this way. I think that the 
responsibility for the critical infrastructure protection rests 
within the information analysis and infrastructure protection 
component of the Department. I believe that that responsibility 
should squarely rest within that component.
    Due to the wisdom of the people that came together to 
create the Homeland Security Act, my position is not Senate 
confirmable. And I would not like to have anyone working for me 
that has a more stringent requirement that do not have to meet. 
So that would be my answer back on that point.
    Senator Akaka. Secretary, I am concerned about a trend at 
DHS of relying on private contractors to fill critical 
functions within the Department. For example, I understand that 
the new domestic Nuclear Detection Office will be run almost 
entirely by contractors. My question to you is, would you 
expect chemical security regulation to be executed by career 
employees, or contractors? And what role would you see 
contractors playing?
    Mr. Stephan. Sir, in terms of the manpower and the subject 
matter expertise necessary to execute that mission, absolutely 
no exceptions, the program management responsibilities should 
rest with a government employee, under all circumstances. That 
is the way the Federal Government operates. That is the way we 
assure accountability and measurable progress across what we 
do.
    Not to say that there need to be integrated into this mix 
appropriately the subject matter expertise that we would need 
to in order to be able to have on our staff the ability to have 
vulnerability folks, consequence folks, threat-focused 
individuals, that may or may not exist within the Federal 
family or the government family at this point.
    Any use of contractors that we would employ would involve 
tight supervisory controls levied upon them by Federal 
Government employees.
    Senator Akaka. One reason I ask that is that it is critical 
that we are able to keep developments and new ideas within the 
Federal level. And if we had contractors do that, it doesn't 
really--it is not administered by the Federal Government.
    Deputy Administrator Dunne, the EPA has special expertise 
in the chemical industry, if DHS assumes the responsibility for 
chemical security regulation, what role do you think EPA should 
play?
    Mr. Dunne. Well, I think we would continue in a support 
role. And I appreciate the fact that I think you recognize that 
you can only have one department or agency in charge of this 
effort. I think splitting authorities would be the wrong thing 
to do.
    And we would provide whatever assistance that is necessary, 
similarly to the way we do in responding to emergencies when 
there is a presidential declaration. We respond on a regular 
basis with whom we have a long working relationship, with FEMA. 
And we would continue to support Bob and his people in terms of 
any efforts in terms of our expertise, which is really in the 
inside-the-gate chemical side of the business; not outside-the-
gate. We are not security experts.
    Senator Akaka. Does DHS plan to involve EPA, do you think, 
in regulation of the chemical industry?
    Mr. Stephan. The ownership, I believe, of the regulatory 
authorities needs to be squarely within one department. That 
would be the Department of Homeland Security. That is not to 
say that we would not need a partnership with the EPA. Because 
as much as people would like to, you can't completely drive a 
wedge between safety and security concerns. They have to be 
woven together.
    And I think we have a great partnership with the EPA. We 
would like to rely upon the solid baseline and safety that they 
have set up through their regulatory structure over the years, 
and be a partner with them to solve this problem. But clearly, 
the authority for security for the chemical sector needs to 
reside with the Department of Homeland Security.
    Senator Akaka. Thank you very much for your responses.
    Madam Chairman, I thank you for being so generous and 
letting me go forward. And I will submit my other questions for 
the record.
    Chairman Collins. Thank you very much, Senator.
    Colonel, I want to get back to the numbers issue. I am very 
aware that the EPA uses a different methodology than DHS. But 
as Senator Lautenberg's questions, and mine, have shown, there 
is confusion over how we get from the 15,000 high-risk 
facilities identified by the EPA to the 3,400 facilities 
identified by DHS.
    And I think because many of the legislative proposals that 
we are going to consider are likely to have a tiered approach 
to regulation, it is important to understand how we define the 
highest-risk facilities. So, if you could, explain to the 
Committee how DHS took the 15,000 RMP facilities list, with 
which it is my understanding you started, and narrowed it down 
to the 3,400 facilities. I am not critical of the narrowing 
down. I just need to understand it.
    Mr. Stephan. And let me provide to you as much clarity as a 
political science major can provide in the math issue area, 
here.
    Working from that initial list of 15,000 that has been the 
baseline that both the EPA and the Department of Homeland 
Security have used, did an initial chop on that list. From that 
initial chop, approximately 2,000 entries were struck because 
they were redundant. For example, one particular facility on 
the list actually appeared twice; once for its fluorine content 
on-site, and once for its sulphur dioxide content. So we had 
several facilities that were listed several times, and we 
boiled that down simply by eliminating the redundant entries.
    Then, another 3,000, generally, were struck from the list 
because they were no longer RMP-applicable, under the EPA 
meaning of that term. Specifically, they had gone out of 
business; they were a tenant plant on a larger site whose host 
organism or entity had been reported in as part of the 
reporting requirements; they were part of a joint venture and 
both partners reported them accidentally; or they had reduced 
chemical holdings on-site below the threshold required by the 
EPA.
    So as we are now winnowing down, based upon redundancies 
and based on facilities that no longer met the EPA requirement, 
we come out through another winnowing window.
    There were another 8,000 on the list of these sites that we 
believe are under somebody else's existing regulatory framework 
with the security component. For example, 4,000 water 
facilities that are under, in the President's structural 
organization of the CIP mission area, the EPA's responsibility, 
using the Bioterrorism Act, the Safe Drinking Water Act; allows 
them authorities to demand vulnerability assessments, takes 
some protective measures, so on and so forth.
    When we boiled all of those out, that got us down to about 
the 3,400 list of things that we consider to be high risk, that 
fell within no one else's regulatory purview, so that we could 
drill down and focus on those as kind of a nexus of our initial 
concern.
    As we work with you to build this regulatory framework, the 
very first thing we are going to have to do is come to an 
adequate agreed-upon definition of what the chemical sector 
actually is; because without that, we will be going all over 
the place. Because I think--there are actually, if you put the 
whole world of anything that has a bottle of chemicals on it 
somewhere in the United States of America, I think there are 
about 66,000 of those things out there.
    So we have to be very careful that we drill down; figure 
out what needs to be inside this regime, what is adequately 
being taken care of under another regulatory framework, as long 
as that framework is risk-based. So we are going to have to 
work up-front to build in the definitional pieces of this.
    Chairman Collins. Thank you. That explanation was very 
clear and very helpful. There is another numbers issue on which 
I want to make sure we have clarity. In your testimony, you 
referred to the 20 percent gap. These are chemical facilities 
that are not adhering to voluntary industry codes, and we do 
not know much about them as far as their security. But it is my 
understanding that you are talking about 20 percent of the 
high-risk pool. Is that correct?
    Mr. Stephan. That is correct.
    Chairman Collins. And this is an important point, because 
it is my understanding that out of the 15,000 high-risk 
facilities that the EPA has identified, only about 1,000 
facilities adhere to the voluntary codes. Is that accurate?
    Mr. Stephan. I would have to defer to the EPA on that 
question.
    Chairman Collins. Mr. Dunne.
    Mr. Dunne. I think it is a little bit more than 1,000; but 
correct, about 7 or 8 percent, I think. But there are other 
associations that have similar types of codes, so I would think 
that maybe it is a couple of thousand out of the 15,000 that 
are following some kind of security measure right now.
    Chairman Collins. Thank you. That is helpful. Mr. Dunne, at 
the Committee's last hearing, Carolyn Merritt, who chairs the 
U.S. Chemical Safety and Hazard Investigation Board, testified 
that, ``Many incidents that the Chemical Safety Board has 
investigated reveal serious gaps in how well companies, 
emergency responders, government authorities, and the public 
are prepared for a major chemical release. These gaps in 
preparedness leave Americans vulnerable.'' She went on to say 
that, ``In her judgment, many communities are not even ready 
for a small chemical release.'' Do you agree with that 
assessment?
    Mr. Dunne. Well, I do not know how many cases the lady has 
really looked at. They only investigate a handful of cases 
after there is an accident. I am not too sure how you draw that 
conclusion.
    Madam Chairman, there are established by law, under the 
Emergency Planning and Community Right To Know Act, over 3,900 
local emergency planning committees. And they are set up by 
States. They are not mandated by the Federal Government. States 
have got them. And they range from one LEPC a State in a couple 
of cases, to hundreds in other States. So you have got a real 
split in terms of how this approach is taken by the States.
    We did a survey back in 1999 to see how many of them were 
really active, out of the 3,900. And the conclusion, I believe, 
was about 59 to 60 percent are active. And ``active'' means a 
variety of things. We can take you down to areas in the country 
where there are processing and refineries right there, and you 
will see LEPCs that are getting money from the industry people 
to staff and have appropriate administrative support; to people 
in other areas of the country where an LEPC may be meeting once 
a year and having discussions.
    I think, in terms of the emergency response community, they 
are getting better and better. There is an enormous effort and 
a large amount of money that has gone into training and 
exercises and acquiring protection.
    Are we there? Nowhere near it, I suspect. And I think by 
and large the larger companies are fairly well prepared, from 
what we can understand, at least in the safety, and not talking 
to the security. And I am sure there are small- or medium-sized 
firms that are the major concern.
    So I can't really respond directly to her statement, but I 
can say that I am sure we are not well prepared across the 
board all the time.
    Chairman Collins. Let's talk about some specifics. I 
understand that the Administration wants to work with this 
Committee, and I very much appreciate that commitment. But let 
me start by asking you about a set of principles that the 
Administration developed in February 2003 to apply to chemical 
security legislation.
    One principle that the Administration endorsed at that time 
was to require an assessment of each facility's vulnerability 
to various modes of attack, and strategies to counter the 
vulnerabilities identified. I asked you a question related to 
this at the beginning of the hearing. Does that sound to you 
like a reasonable requirement to include in legislation?
    Mr. Stephan. Madam Chairman--and again, I will have to 
apologize, because I do not have any details that have been 
vetted through my policy framework and approved by Secretary 
Chertoff to bring to you today; but we are working on those in 
accelerated manner.
    As I discussed, however, earlier, there is just a certain 
set of things that would be an appropriate part, or an 
appropriate portion of any framework dealing with security from 
a regulatory perspective. People have got to be doing some kind 
of sanctioned approach to risk assessments. Some people have 
got to be taking action based upon those risk assessments, 
implementing measures that are measurable. And there has to be 
a system in place to develop an auditing or a tracking of all 
this, and then a compliance piece to all of it.
    So I think if I were speaking about the chemical sector or 
any other sector, to get at a regulatory structure it has got 
to have those key components embedded somewhere, somehow. The 
devil is in the details, as you pointed out earlier.
    Chairman Collins. But surely, you can't get to the audit 
and compliance areas unless you have some sort of baseline 
requirement for a vulnerability assessment and for the 
development of strategies to counter the vulnerabilities. I 
mean, that seems to me to be so basic to the legislation that I 
think it is safe for you to say ``Yes.'' [Laughter.]
    Mr. Stephan. Safety is always a concern. But again, I have 
no specific pieces of the framework. I can't imagine a 
framework that did not include assessing----
    Chairman Collins. I can't, either.
    Mr. Dunne [continuing]. Or not necessarily focused on 
vulnerability, but risk; because we have to take into account 
consequences, threat, and vulnerabilities, as part of an 
overall risk-based approach.
    Chairman Collins. Well, let me turn to another possible 
framework, because we are searching for the right way to do 
this. Mr. Dunne, for example, you brought up the interesting 
point that we do not want to provide a road map to the 
terrorists. I think that is an excellent point that we are 
going to have to keep in mind.
    Secretary Chertoff has indicated that the framework that 
was established under the Maritime Transportation Security Act 
has proven highly successful. The MTSA requires the Coast Guard 
to promulgate performance-based regulations and to form area 
maritime security committees, to designate a Federal maritime 
security coordinator, to complete facility and area maritime 
security plans, compile a list of critical infrastructure in 
our ports.
    Is that a possible framework for us to look to when it 
comes to regulating chemical security, in your view?
    Mr. Stephan. Yes. And that is absolutely one of the 
frameworks that we are going to consider, because we do think 
that particular way of doing business has achieved a certain 
level of success. We just have to, again, map it against 
whatever these criteria end up being that we can mutually agree 
upon, and see if there are any deltas between the NTSA approach 
and whatever the overall more encompassing approach would be.
    The second bit of interesting news there, though, is the 
Coast Guard appears to have achieved an incredible amount of 
efficiency and acceptance as a regulator. And we would love to 
model the Coast Guard's approach to dealing with the private 
sector yet getting the job done efficiently and effectively. So 
we want to actually sit down with them, and we have in a 
preliminary sort of way, to figure out how they have been able 
to crack that code.
    Chairman Collins. I think the Coast Guard is an ideal model 
for us to take a look at, and I certainly agree with you on the 
acceptance and the respect that the public has in dealing with 
the Coast Guard on a lot of port security and maritime 
interdiction issues as well.
    I want to turn to the buffer zone program. It is ironic to 
me that you testified today, as the Secretary frequently has, 
that we should have a completely risk-based approach to 
funding, but that is not really what the buffer zone protection 
program funding is based on. Isn't it a flat $50,000, with only 
a 15 percent variance up or down, regardless of what the site 
is?
    Mr. Stephan. Yes, ma'am, that is correct. And right now, 
the buffer zone protection plan scheme of maneuver does have a 
risk component to it; in that it is targeted against what we 
consider to be the top 272 highest-risk facilities in the 
chemical sector. So that portion of it--in terms of drilling 
down to who would be eligible, who we are going to work with, 
who we think needs this level of focus--that is completely 
risk-based.
    This first year of its implementation, we basically did the 
best we could, in terms of trying to come up with some 
equitable way to push some quality improvements and capability 
out the door. I think, based upon not having the risk 
management tool that we now are ready to deploy across the 
sector, that is the best foot forward we could have put a year 
ago when we came up--or over a year ago when we came up with 
the idea for this program.
    I think, beginning with the next budget cycle, you will be 
able to see from us a much more measured risk-based approach, 
simply because the technology has now caught up with us. And we 
want to fully employ that in terms of determining criticality 
against which we will base our decisions about where to push 
the buffer zone protection plan grant monies.
    Chairman Collins. Mr. Dunne, you gave us one caution as we 
draft this legislation, about spelling out too many 
requirements that might result in plans that were available to 
the public and could be used to cause us harm, to be turned 
against us. Do you have any other cautions for this Committee, 
as we draft this legislation?
    Mr. Dunne. Well, when you referred to the principle, that 
was interesting. I would agree that, where necessary, 
assessments have to be done and a plan has got to be done, and 
it has got to be able to be checked. We had discussions back 3 
years ago that, if this either was done through our own 
regulation or we were going to go by law, that we were of the 
belief that the plans and the assessments and the vulnerability 
analysis should not leave that facility; should stay with the 
unit there.
    Now, the Water Bioterrorism Act does have the water plans 
coming to EPA. It is locked; it is secured. And that has got 
very limited access. Law enforcement and some of the DHS people 
have some access to it, and it is a very limited number of 
people.
    I think on the security side, in terms of what is being 
done inside that facility, it can be very dangerous unless we 
protect those sources. So I would think that doing the analysis 
and doing the plans on the recovery is really necessary, but 
limiting the access to that information is really necessary.
    Chairman Collins. Is that in conflict with the community 
right-to-know law?
    Mr. Dunne. No, actually, the risk management plans under 
Section 112(r) are available to the public. In fact, we had a 
long, spirited debate within the Agency whether or not the 
executive summaries ought to be released. After September 11, 
we decided to withhold those.
    We recently have just let those go. But in terms of 
consequences, they are only available in reading rooms in 50 
areas, either EPA's offices or the FBI offices. And they are 
not visited that often. Mainly, I was told today, they are 
visited more by the press. And they are paper copies only, and 
you can only go in and look at one facility at a time, and 
there is a limited number of times you can.
    And so we have tried to restrict that information. And 
actually, there was a law passed in 1999 that led us to it. 
This is not something that EPA just dreamt up. There was a 
security law, and the acronym is ``SFRA.'' And we do take a 
look at whether or not--if this got into the wrong hands, could 
they create harm. And that is why we make sure that we adhere 
to that principle that was put in the act in 1999.
    Chairman Collins. It seems to me that there is a potential 
tension here because, on the one hand, you certainly do not 
want to provide terrorists with information on how to attack a 
facility and what its vulnerabilities are; on the other hand, 
you do want local law enforcement and emergency response 
officials to understand the vulnerabilities in order to improve 
their preparedness. How do we strike the right balance on that?
    Mr. Dunne. Well, no, I do not think there is a conflict in 
that. Actually, under the safety plans, that information is 
available. Law enforcement, fire departments, and other people 
have to prepare outside the gate for emergency response. And 
that is why the Congress had the States come up with local 
emergency planning committees. So I do not think there is a 
conflict.
    There are certain conditions within a facility that, if it 
became known to a person who wanted to create harm, could 
create havoc for us. So I make the distinction in terms of 
keeping those plans inside the gate. But I think the law 
enforcement community, fire people, and the emergency response 
people should have access, in terms of what the vulnerabilities 
are and what type of activities they are going to have to 
undertake to plan and prepare for a response.
    Chairman Collins. Colonel, any advice to us, any cautions, 
as we proceed to draft legislation?
    Mr. Stephan. Ma'am, again, just to restate a few key 
points, we are really looking to do this in a fair and 
balanced, yet effective manner. Because this sector is vitally 
important to the Nation in terms of what it represents to our 
economy, what it represents to the daily lives of Americans 
across the country.
    By that same token, it is a very important security risk, 
not only because of the economic consequences involved, but the 
public health and safety dimension of all this. That drives us 
to it.
    We think now we are grown up enough, we are mature enough 
in both our knowledge base, the stuff that the private sector 
has done, and the technologies that we have to use to guide a 
risk assessment process. Let's work together to make sure we 
put the right structure in place, so that we are not 
crippling--or helping al Qaeda and the like by crippling a 
vital part of our economy while trying to secure it.
    I think there is a way we can take a measured, balanced 
approach so that we can close the remaining gaps for that 20 
percent or so capacity we are worried about; make sure we can 
sustain the good efforts that have been done by industry 
voluntarily over time; and to make sure that those voluntary 
efforts are achieving the effects we want to see.
    And I think there is a way to do that, and we have some 
really smart, gifted, talented people that will help us on our 
end put those principles in motion. And we want to do it on an 
accelerated track through our policy process, and sit down and 
work with you to see what this means as quickly as we can.
    Chairman Collins. Thank you. I want to thank you both for 
your testimony today. We are on an accelerated time-frame for 
completing this legislation. I intend to hold additional 
hearings, to hear from industry groups, homeland security 
experts, environmental groups, and others that have an interest 
in this area. My hope then is to use the August recess to 
complete the drafting of a bill, and then introduce it--I hope, 
with bipartisan support--in September.
    I tell you that time-frame because we will need the 
Administration's assistance and guidance and input very 
quickly. I am convinced that legislation is needed. I am very 
pleased to hear the Administration endorse a legislative goal. 
But we need your help on specifics. We have not talked much 
about what the legislation should contain today.
    So I look forward to continuing our dialogue and to working 
with you on an expedited basis. I want to thank you for your 
help today.
    This hearing record will remain open for 15 days. I also 
want to thank my staff for all of their work on this important 
issue. The Committee hearing is now adjourned.
    [Whereupon at 12:06 p.m., the Committee was adjourned.]
                            A P P E N D I X

                              ----------                              


                PREPARED STATEMENT OF SENATOR VOINOVICH
    Chairman Collins, thank you for holding this hearing today. The 
chemical industry is a critical component of our Nation's 
infrastructure. I complement your attention to the security of this 
industry and I look forward to working with the Members of the 
Committee, the Department of Homeland Security, and the Stakeholder 
community to ensure that our Nation's chemical sector is secure from 
the threat of terrorist attacks.
    As I have previously noted, the chemical industry contributes to 
our high quality of life, whether it be enhanced crop production, 
improved water chlorination, effective household cleaners or advanced 
life-saving medications. However, these benefits do not come without 
risk.
    During the Committee's first chemical security hearing on April 27, 
we heard alarming statistics that warned of a devastating loss of life 
in the event of a terrorist attack against a major chemical facility. 
Depending on the severity of the attack, the statistics ranged from 
10,000 to an unfathomable 2.4 million casualties.
    Today, we will hear from both the Environment Protection Agency 
(EPA) and the Department of Homeland Security (DHS). I understand that, 
since assuming jurisdiction of chemical industry security, DHS has made 
significant modifications to both the method of risk assessment and the 
strategy for prevention and protection from terrorist attacks. I look 
forward to obtaining the Department's risk assessment and learning the 
actions it is taking to mitigate our vulnerabilities.
    However, I believe that the Federal Government can not protect 
against every threat. Therefore, I want to reiterate my support for a 
balanced approach between self-regulation by industry and more 
proactive Federal action. Industry leaders, like the American Chemistry 
Council, should be commended for building a strong foundation for 
chemical safety. It is my hope that the significant safety measures 
developed by industry will be further built upon and incorporated into 
our overall chemical security efforts.
    As we further explore this issue, we must be governed by four 
guiding principles:

      First, efforts to enhance the security of our facilities 
should be sharply focused on prevention, protection, and consequence 
management of potential terrorist attacks;

      Second, Federal action to address chemical 
vulnerabilities must not be burdened with extraneous issues that are 
strictly environmental in nature;

      Third, critical information must be protected from 
unnecessary public disclosure, providing it only to responsible 
government authorities that need to have access to such information; 
and

      Fourth, Federal action should adhere to a comprehensive 
cost-benefit analysis, not placing industry at a competitive 
disadvantage.

    In Ohio, the chemical industry directly employs 48,900 people: The 
impact of these jobs reverberates throughout Ohio, as one job in the 
chemical industry creates another 6.2 jobs for the State's economy.
    The chemical industry is experiencing economic hardship as a result 
of rising natural gas costs. As we move forward in efforts to secure 
your chemical industry infrastructure from a terrorist attack, we must 
be certain that our efforts do not unwittingly create onerous Federal 
regulations that jeopardize the industry's viability.
    As I have said before, it is not economically feasible to protect 
everything; doing so would bankrupt the Nation. Accordingly, all 
security enhancements including the security of our Nation's chemical 
infrastructure should be based, first and foremost, on risk and 
vulnerability.
    Chairman Collins, thank you for holding this hearing. I look 
forward to working with you on this issue.
                               __________
                 PREPARED STATEMENT OF SENATOR COLEMAN
    I want to thank Chairman Collins and Senator Lieberman for holding 
this important hearing to examine what the Federal Government is doing 
to secure chemical facilities to determine if more authority is needed.
    Securing the chemical sector is a complex undertaking but vital to 
protecting our homeland. There are literally thousands of chemical 
facilities that work with large quantities of hazardous materials 
throughout the country and they are located in or near major cities as 
well as rural areas. Minnesota has 20 chemical facilities that are 
considered to be ``high-risk'' on the National Asset Database and 
chemical security is of concern to the residents of Minnesota.
    As a result of the 1984 accident at the Union Carbide pesticide 
plant in Bhophal, India, Congress passed the Emergency Planning and 
Community Right-to-Know Act, or EPCRA, to reduce the risk to the 
general public associated with the accidental release of hazardous 
chemicals from chemical facilities by requiring State and local 
governments as well as facility operators to prepare plans for any 
accidental releases. In addition to the EPCRA, the Clean Air Act 
required chemical owners and operators to prepare Risk Management 
Plans, or RMPs to summarize the potential threat and worst-case 
scenario.
    The focus of these laws and requirements were enacted during a 
different period when the Federal Government was rightly concerned with 
the safety of these facilities. However, in the post-September 11 
world, we have had to create new prevention and response plans that 
focus on intentional threats to our critical assets. Although there is 
not a uniform standard for securing chemical facilities, it is 
important to note that the Department of Homeland Security has taken 
steps to identify and prioritize the highest-risk chemical facilities 
and provide guidance to the owners and operators on increasing security 
in and around their facilities. The chemical industry has also made 
investments in traditional physical security measures and many 
facilities have voluntarily adopted the Responsible Care security 
recommendations of the American Chemistry Council.
    While these efforts have increased security, it is clear much work 
still remains in terms of securing the chemical sector. Instead of 
security being a cost of doing business--it needs to become a way of 
doing business. And as we move forward, it is crucial that Congress, 
the Administration and the industry work together to ensure that 
sufficient prevention and response plans are in place at our Nation's 
chemical facilities.
    I look forward to hearing the testimony of our panelists about the 
state of security in the chemical sector and what additional authority 
may be necessary to maintain or increase that security.
[GRAPHIC] [TIFF OMITTED] 21829.001

[GRAPHIC] [TIFF OMITTED] 21829.002

[GRAPHIC] [TIFF OMITTED] 21829.003

[GRAPHIC] [TIFF OMITTED] 21829.004

[GRAPHIC] [TIFF OMITTED] 21829.005

[GRAPHIC] [TIFF OMITTED] 21829.006

[GRAPHIC] [TIFF OMITTED] 21829.007

[GRAPHIC] [TIFF OMITTED] 21829.008

[GRAPHIC] [TIFF OMITTED] 21829.009

[GRAPHIC] [TIFF OMITTED] 21829.010

[GRAPHIC] [TIFF OMITTED] 21829.011

[GRAPHIC] [TIFF OMITTED] 21829.012

[GRAPHIC] [TIFF OMITTED] 21829.013

[GRAPHIC] [TIFF OMITTED] 21829.014

[GRAPHIC] [TIFF OMITTED] 21829.015

[GRAPHIC] [TIFF OMITTED] 21829.016

[GRAPHIC] [TIFF OMITTED] 21829.017

[GRAPHIC] [TIFF OMITTED] 21829.018

[GRAPHIC] [TIFF OMITTED] 21829.019

[GRAPHIC] [TIFF OMITTED] 21829.020

[GRAPHIC] [TIFF OMITTED] 21829.021

[GRAPHIC] [TIFF OMITTED] 21829.022

[GRAPHIC] [TIFF OMITTED] 21829.023

[GRAPHIC] [TIFF OMITTED] 21829.024

[GRAPHIC] [TIFF OMITTED] 21829.025

[GRAPHIC] [TIFF OMITTED] 21829.026

[GRAPHIC] [TIFF OMITTED] 21829.027

[GRAPHIC] [TIFF OMITTED] 21829.028

[GRAPHIC] [TIFF OMITTED] 21829.029

                                 
