Homeland Security: Department of Justice's Response to Its	 
Congressional Mandate to Assess and Report on Chemical Industry  
Vulnerabilities (10-OCT-02, GAO-03-24R).			 
                                                                 
Congress passed the Chemical Safety Information, Site Security	 
and Fuels Regulatory Relief Act after a number of testimonies	 
expressing concerns about the vulnerability of chemical 	 
facilities to criminal and terrorist attacks. According to the	 
Attorney General's interim report, chemical facilities visited	 
generally had safety and emergency response measures that could  
mitigate the consequences of a terrorist attack. The report	 
further stated that the level of security at chemical facilities 
is roughly equivalent to standard security practices found in	 
most industries. The interim report also contains nine		 
preliminary findings that cumulatively address the other required
reporting elements--the vulnerability of facilities to criminal  
and terrorist activity, current industry site security practices,
and the security of chemicals being transported. These findings  
address the extent to which 11 facilities conducted facility	 
security assessments, had the capability to respond to armed	 
attacks, conducted emergency response exercises, conducted	 
routine pre-employment background investigations, had secure	 
process control systems, had secure chemical transportation	 
containers, had adequate security measures over transportation of
hazardous chemicals, received meaningful threat information, and 
had effective facility security systems.			 
-------------------------Indexing Terms------------------------- 
REPORTNUM:   GAO-03-24R 					        
    ACCNO:   A05276						        
  TITLE:     Homeland Security: Department of Justice's Response to   
Its Congressional Mandate to Assess and Report on Chemical	 
Industry Vulnerabilities					 
     DATE:   10/10/2002 
  SUBJECT:   Counterterrorism					 
	     Facility security					 
	     Industrial facilities				 
	     National preparedness				 
	     Reporting requirements				 
	     Terrorism						 

******************************************************************
** This file contains an ASCII representation of the text of a  **
** GAO Product.                                                 **
**                                                              **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced.  Tables are included, but    **
** may not resemble those in the printed version.               **
**                                                              **
** Please see the PDF (Portable Document Format) file, when     **
** available, for a complete electronic file of the printed     **
** document's contents.                                         **
**                                                              **
******************************************************************
GAO-03-24R

GAO- 03- 24R Security of Chemical Facilities United States General
Accounting Office

Washington, DC 20548

October 10, 2002 The Honorable John D. Dingell Ranking Minority Member
Committee on Energy and Commerce House of Representatives

The Honorable Frank Pallone, Jr. Ranking Minority Member Subcommittee on
Environment and Hazardous Materials Committee on Energy and Commerce House
of Representatives

Subject: Homeland Security: Department of Justice*s Response to Its
Congressional Mandate to Assess and Report on Chemical Industry
Vulnerabilities

On August 5, 1999, after a number of testimonies expressing concerns about
the vulnerability of chemical facilities 1 to criminal and terrorist
attacks, Congress passed the Chemical Safety Information, Site Security
and Fuels Regulatory Relief Act (CSISSFRRA), 2 which, among other things,
required the Department of Justice to review the vulnerability of these
facilities. The act also required the Attorney General to prepare two
reports* an interim report containing preliminary findings by August 5,
2000, and a final report by August 5, 2002.

Specifically, Justice was to address the extent to which Clean Air Act
regulations regarding the prevention of accidental releases have resulted
in actions, including the design and maintenance of safe chemical
facilities, that are effective in detecting, preventing, and minimizing
the consequences of regulated substances that may be released as a result
of criminal activity. Furthermore, using available data to the extent
possible and a sample of facilities, and consulting with appropriate
state, local, and federal government agencies, affected industry, and the
public, Justice was to

1 We use the term *chemical facilities* in this report to mean those
stationary sources covered under section 112( r) of the Clean Air Act. 2
Pub. L. No. 106- 40, 113 Stat. 207 (1999).

GAO- 03- 24R Security of Chemical Facilities 2 review the vulnerability of
chemical facilities to criminal and terrorist activity,

current industry practices regarding site security, and the security of
transportation of regulated substances. Finally, Justice was to include
recommendations, if any, for reducing the vulnerability of these
facilities to criminal and terrorist activities. The interim report was to
include, at a minimum, preliminary findings from this review, the methods
used to develop the findings, and an explanation of the activities
expected to occur that could cause the findings in the final report to
differ from those in the interim report. The final report was to discuss
the complete results of the review. CSISSFRRA authorized to be
appropriated such sums as necessary to carry out the requirements.

In a separate but related action, the October 2000 Conference report 3 on
Justice*s appropriation act for fiscal year 2001 directed Justice to use
$600,000 of the Office of Justice Programs, Justice Assistance
appropriation for its National Institute of Justice to develop, test, and
validate a prototype vulnerability assessment methodology to assess the
security of chemical facilities against terrorist and criminal acts,
consistent with the CSISSFRRA requirements. 4

As part of our ongoing study of chemical industry security, you asked us
to describe Justice*s actions to comply with the 1999 congressional
mandate to review and report on the vulnerability of chemical facilities.
This report responds to that request. As agreed, we will report early next
year on other issues concerning the security of chemical facilities.

Justice Initiated Actions to Study the Vulnerability of the Chemical
Industry but Has Not Fully Met Its Statutory Requirements

Justice has only partially fulfilled the requirement to review and report
on the vulnerability of chemical facilities to terrorist or criminal
attack. Justice prepared and submitted an interim report to Congress in
May 2002. The interim report was based on observations made at 11 chemical
manufacturing facilities Justice visited in developing a methodology
requested by its appropriations conference committee. The facilities
visited represent only a small portion of the 15,000 chemical facilities
subject to the Clean Air Act*s risk management plan provisions. While the
interim report contains the elements required by CSISSFRRA, it was
submitted nearly 2 years after it was due, and the results cannot be
generalized to the industry as a whole.

Additionally, Justice did not submit its final report to Congress by
August 5, 2002, as required. Justice told us that because of competing
priorities in its budget, it had not yet conducted a more comprehensive
final study. While Justice determined that it did not have adequate funds
to conduct the study of the vulnerability of chemical facilities to
attack, it did not formally request additional funds from Congress for
this purpose in fiscal year 2001 or 2002. Justice has asked for $3 million
in its fiscal year 2003 budget request and plans to conduct the study and
issue the final report if it receives these funds. We note that Justice
should have used its existing

3 H. R. Conf. Rept. No. 106- 1005, at 223 (2000). 4 The Departments of
Commerce, Justice, and State, the Judiciary, and Related Agencies

Appropriations Act for fiscal year 2001, Pub. L. No. 106- 553, 114 Stat.
2762, was not enacted until December 21, 2000.

GAO- 03- 24R Security of Chemical Facilities 3 appropriations for the
study. Generally, when Congress imposes a new requirement

on an agency but does not appropriate funds specifically to implement it,
the agency must use existing appropriations to fund the requirement. 5

Justice*s Interim Report Was Based on Observations Made While Developing a
Methodology to Assess Chemical Facilities* Vulnerability to Terrorist
Attack

Justice determined that the first step in meeting the CSISSFRRA
requirements was to develop a methodology to assess the security of
chemical facilities. On March 31, 2000, the Justice submitted notice to
the House and Senate Committees on Appropriations that it planned to
transfer $750,000 from the Counterterrorism appropriation to the Office of
Justice Programs appropriation to develop a methodology. According to
Justice, the committees disagreed with the transfer and Justice elected
not to proceed with it.

A conference committee later directed Justice to use $600,000 of the
Office of Justice Programs, Justice Assistance appropriation for the
department*s National Institute of Justice to develop, test, and validate
a prototype vulnerability assessment methodology to assess the security of
chemical facilities against terrorist and criminal acts, consistent with
the CSISSFRRA requirements. 6

In January 2001, Justice, together with the Department of Energy*s Sandia
National Laboratory, began developing, testing, and validating the
vulnerability assessment methodology. The methodology provides a tool to
identify risks and mitigate the consequences of terrorist attacks. In July
2002, Justice made the completed methodology publicly available to assist
chemical companies in identifying and assessing their threats, risks, and
vulnerabilities. In addition, chemical industry associations are
encouraging their members to use this methodology to evaluate their
facilities.

On the basis of observations made during the development of the
methodology, Justice prepared a 12- page interim report to Congress in
response to the CSISSFRRA requirement. Justice determined that the report
contains information that if released would pose a threat to national
security and therefore has not made it publicly available. 7 As required,
the interim report (1) provides preliminary findings, (2) discusses the
methods used to develop those findings, (3) includes Justice*s
recommendations for reducing the vulnerability of facilities to terrorist
activity, and (4) explains activities expected to occur that could result
in differences between the findings in the interim and final reports. The
interim report does not assess overall security at chemical facilities,
but rather, it provides observations Justice made about security at a few
facilities during the development of the methodology.

5 See B- 195007, July 15, 1980; 46 Comp. Gen. 604 (1967); 15 Comp. Gen.
167 (1935). 6 The October 2000 Conference report on Justice*s
appropriation act for fiscal year 2001 directed this

action. Additionally, the Conference report required Justice to submit a
report on the findings derived from the development of the methodology.
Justice submitted this report to its appropriations committees in May
2002. 7 Justice made this determination pursuant to 42 U. S. C. 7412( r)(
7)( H)( xi)( III).

GAO- 03- 24R Security of Chemical Facilities 4 Interim Report*s
Preliminary Findings

The interim report discusses two preliminary findings that address the
extent to which the Clean Air Act*s accidental release regulations have
resulted in actions that are effective in detecting, preventing, and
minimizing the consequences of releases of regulated substances that may
be caused by criminal and terrorist activity. According to the report,
chemical facilities visited generally had safety and emergency response
measures that could mitigate the consequences of a terrorist attack. 8 The
report further stated that the level of security at chemical facilities is
roughly equivalent to standard security practices found in most
industries. However, we could not determine from our discussions with
Justice officials what work was performed to support this finding, and we
are continuing to investigate this issue as part of our ongoing review.

The interim report also contains nine preliminary findings that
cumulatively address the other required reporting elements* the
vulnerability of facilities to criminal and terrorist activity, current
industry site security practices, and the security of chemicals being
transported. These findings address the extent to which the 11 facilities

conducted facility security assessments,

had the capability to respond to armed attacks,

conducted emergency response exercises,

conducted routine pre- employment background investigations,

had secure process control systems,

had secure chemical transportation containers,

had adequate security measures over transportation of hazardous chemicals,

received meaningful threat information, and

had effective facility security systems. Concerning transportation,
Justice officials told us that their observations to date were limited to
the transportation of chemicals within a facility and that a broader
review of transportation vulnerabilities outside a facility is needed.

Methods Used to Develop Preliminary Findings Justice*s preliminary
findings are based on the work that it and Sandia did to develop the
vulnerability assessment methodology. Consequently, the scope and
limitations of the interim report*s preliminary findings are the same as
those for the methodology. In developing the methodology, Justice
identified approximately 15,000 U. S. facilities that produce, dispose of,
or in some manner handle or use hazardous chemicals. Justice focused on
chemical facilities that manufactured chemicals hazardous to human life.
These were chemicals that, if inhaled or touched by individuals, would
cause harmful or lethal results. To develop and test the methodology,
Justice and Sandia personnel met with industry and government officials
and visited 11 chemical manufacturing facilities from April 2001 through

8 We only discuss selected information from the interim report that
Justice has determined does not pose a threat to national security.

GAO- 03- 24R Security of Chemical Facilities 5 January 2002. These
facilities were selected in consultation with personnel from the

American Chemistry Council, the chemical manufacturing industry's trade
association, who suggested that the security at these facilities was
representative of a broad range of facilities in the industry. These
facilities represented a range of characteristics such as (1) location*
six urban and five rural sites and (2) the number of employees* three had
more than 1,000 employees, three had fewer than 100 employees, and the
remaining five ranged from 100 to 1,000 employees. Justice and Sandia
focused primarily on physical security at fixed sites* the security of
electronic chemical process control systems and transportation systems was
a secondary focus.

Because the findings in the interim report are based on visits to only 11
facilities, the report states that caution should be exercised in
generalizing the findings to the entire industry. However, the report also
notes that these visits provided the department with the opportunity to
identify potential threats, overall risks, and vulnerabilities at these
chemical facilities. Also, according to Justice, chemical facilities that
store and use chemicals may present fundamentally different security
concerns than chemical facilities that produce or manufacture chemicals*
such as those included in the Justice study* and that, as such, the
preliminary findings and recommendations may not apply other than to
manufacturing facilities. It is important to note that of the
approximately 15,000 facilities covered by the Clean Air Act, according to
an official at the Environmental Protection Agency, only about 1,500
produce or manufacture chemicals.

Interim Report Recommendations The interim report notes that in addition
to the use of effective security systems, other remedial measures should
be considered to lower the probability of a successful terrorist attack.
Justice officials told us that these recommendations apply to the 11
facilities they visited and may not be applicable to other chemical
facilities. While Justice has not made the recommendations publicly
available, officials said that chemical facilities would be able to
identify measures to potentially lower the probability of a successful
terrorist attack when they conduct their own vulnerability assessments.

Potential Differences Between the Interim and Final Reports Justice notes
that its report is based primarily on information and practices developed
prior to September 11, 2001, and therefore the findings in a final report
may differ in some respects from those in the interim report. Furthermore,
some chemical manufacturers have altered their security measures since
September 2001, and those changes may not be fully reflected in the
interim report. According to Justice officials, Sandia visited five
facilities prior to, and six after, September 11, 2001.

GAO- 03- 24R Security of Chemical Facilities 6 Justice Does Not Plan to
Conduct the Study and Issue the Final Report Unless

Congress Provides Requested Funding According to Justice officials,
Justice did not comply with the CSISSFRRA requirement to issue the final
report by August 5, 2002, because it determined that it did not have
adequate funds in its existing budget and Congress has not provided funds
specifically for this purpose. 9 Justice has estimated the study would
cost $7 million, but did not provide the basis for this estimate. And
while Justice could not identify funds to conduct a study of the security
of the chemical industry, it did not ask Congress for funds for this
purpose in fiscal year 2001 or 2002, or in the supplemental appropriations
for either year. Justice has requested $3 million as part of its lump sum
appropriation for Salaries and Expenses, General Administration for fiscal
year 2003 for *chemical plant vulnerability assessments.* 10 According to
officials, Justice does not plan to conduct any further work to assess the
vulnerability of the chemical industry, nor does it plan to issue the
final report to Congress unless Congress enacts the lump sum appropriation
in the amount Justice has requested.

Nevertheless, while Justice*s appropriations acts have not provided the
department an earmark or a specific line item appropriation for this
purpose, Justice does have appropriations legally available for this
purpose. Justice is authorized to use its existing and available lump sum
appropriations for this purpose. Generally, when Congress imposes a
requirement but does not appropriate additional funds to specifically
carry it out, an agency must use an existing appropriation to implement
the requirement* one that is consistent with the purposes of the
particular appropriation being charged for that expense. 11

Justice*s interim report recognizes that a vulnerability assessment would
help identify and set priorities for security vulnerabilities at chemical
facilities, compare security risks across chemical facilities, and help
companies make the best use of security funding and other resources to
address priority vulnerabilities. Furthermore, according to the
administration*s July 2002 National Strategy for Homeland Security,
comprehensive vulnerability assessments of critical infrastructures enable
authorities to evaluate the potential effects of an attack on a given
facility or sector and to invest accordingly.

Agency Comments and Our Evaluation

We provided a draft of this report to the Department of Justice for its
review and comment. Justice agreed with the majority of the observations
contained in the report. However, Justice expressed concern that we did
not place its efforts in the proper context when we observed that it did
not use available funds to address the comprehensive reporting
requirements included in CSISSFRRA. Justice also explained the
notification provisions found in section 605 of its appropriations acts.

9 However, CSISSFRRA authorizes such funds as may be necessary to be
appropriated to Justice to conduct the study and report on the
vulnerability of chemical facilities. 10 Department of Justice, Fiscal
Year 2003 Budget Summary, Salaries and Expenses, General

Administration, Department Leadership. 11 See B- 195007, July 15, 1980; 46
Comp. Gen. 604 (1967); 15 Comp. Gen. 167( 1935).

GAO- 03- 24R Security of Chemical Facilities 7 We recognized the initial
efforts Justice made to address the reporting requirements

included in CSISSFRRA. As we stated in our report, Justice has partially
addressed the CSISSFRRA mandate by preparing an interim report. We also
reported that Justice notified the House and Senate Committees on
Appropriations that it planned to transfer $750,000 from its
Counterterrorism appropriation to develop a methodology. This notice
explained that this money would fund phase one of its project to prepare a
report required by CSISSFFRA. As Justice explains in its comments to us,
section 605 of its appropriations acts required it to notify the
committees of its proposal to use these funds. As we reported, the
appropriations committees disagreed with this transfer and Justice elected
not to proceed. Later, a conference committee directed Justice to use
$600,000 to develop, test, and validate a prototype vulnerability
assessment methodology.

While Justice proposed to use $750,000 in 2000 for the first step in
meeting the CSISSFRRA requirements, it did not attempt to use funds from
any other appropriations or ask Congress for funds to complete a study of
the security of the chemical industry until fiscal year 2003. As we stated
in the report, we believe that when Congress imposes a new requirement on
an agency but does not appropriate funds specifically to implement it, the
agency must use existing appropriations to fund the requirement.

The Department of Justice*s letter to us is contained in enclosure I.

Scope and Methodology

To describe Justice's actions to review the vulnerability of the chemical
industry against criminal and terrorist acts and to fulfill its
statutorily mandated reporting requirements, we reviewed the requirements
of the Chemical Safety Information, Site Security and Fuels Regulatory
Relief Act and Justice*s appropriations for fiscal years 2000 to 2003 and
interviewed Justice officials. We reviewed a copy of the interim report
Justice submitted to Congress and of the vulnerability assessment
methodology developed by Justice and Sandia. We requested a meeting with
the Justice and Sandia personnel who were directly involved with making
the observations on facility security, which was the basis for the interim
report, but to date, Justice has not provided us access to them. We
performed our review from April 2002 through August 2002 in accordance
with generally accepted government auditing standards.

GAO- 03- 24R Security of Chemical Facilities 8 - - - We

are sending copies of this report to interested congressional committees.
We also will make copies available to others upon request. In addition,
the report will be available at no charge on the GAO Web site at http://
www. gao. gov.

If you have any questions about this report, please contact me at (202)
512- 3841. Major contributors to this report were Linda Libician, Leigh
White, Amy Webbink, and Joanna McFarland.

John B. Stephenson Director, Natural Resources and

Environment Enclosure

GAO- 03- 24R Security of Chemical Facilities 9 Enclosure I Enclosure I

Comments from the U. S. Department of Justice

GAO- 03- 24R Security of Chemical Facilities 10 Enclosure I Enclosure I

GAO- 03- 24R Security of Chemical Facilities 11 Enclosure I Enclosure I

(360264)
*** End of document. ***