Combating Bioterrorism: Actions Needed to Improve Security at
Plum Island Animal Disease Center (19-SEP-03, GAO-03-847).
Scientists at the Plum Island Animal Disease Center are
responsible for protecting the nation against animal diseases
that could be accidentally or deliberately introduced into the
country. Questions about the security of Plum Island arose after
the 2001 terrorist attacks and when employees of the contractor
hired to operate and maintain the Plum Island facilities went on
strike in August 2002. GAO reviewed (1) the adequacy of security
at Plum Island and (2) how well the contractor performed during
the strike. The Department of Homeland Security (DHS) assumed the
administration of Plum Island from the Department of Agriculture
(USDA) on June 1, 2003. While DHS is now responsible for Plum
Island, USDA is continuing its research and diagnostic programs.
-------------------------Indexing Terms-------------------------
REPORTNUM: GAO-03-847
ACCNO: A08514
TITLE: Combating Bioterrorism: Actions Needed to Improve
Security at Plum Island Animal Disease Center
DATE: 09/19/2003
SUBJECT: Animal diseases
Biological warfare
Contractors
Counterterrorism
Facility security
Infectious diseases
National preparedness
Performance measures
Physical security
Terrorism
******************************************************************
** This file contains an ASCII representation of the text of a **
** GAO Product. **
** **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced. Tables are included, but **
** may not resemble those in the printed version. **
** **
** Please see the PDF (Portable Document Format) file, when **
** available, for a complete electronic file of the printed **
** document's contents. **
** **
******************************************************************
GAO-03-847
United States General Accounting Office
GAO
Ranking Democratic Member, Committee
on Agriculture, Nutrition and Forestry, U.S. Senate
September 2003
COMBATING BIOTERRORISM
Actions Needed to Improve Security at Plum Island Animal Disease Center
a
GAO-03-847
Highlights of GAO-03-847, a report to the Ranking Democratic Member,
Committee on Agriculture, Nutrition and Forestry, U.S. Senate
Scientists at the Plum Island Animal Disease Center are responsible for
protecting the nation against animal diseases that could be accidentally
or deliberately introduced into the country. Questions about the security
of Plum Island arose after the 2001 terrorist attacks and when employees
of the contractor hired to operate and maintain the Plum Island facilities
went on strike in August 2002. GAO reviewed (1) the adequacy of security
at Plum Island and (2) how well the contractor performed during the
strike. The Department of Homeland Security (DHS) assumed the
administration of Plum Island from the Department of Agriculture (USDA) on
June 1, 2003. While DHS is now responsible for Plum Island, USDA is
continuing its research and diagnostic programs.
GAO recommends that DHS consult with USDA to correct physical security
deficiencies; further limit access to pathogens; consult with other
laboratories to identify ways to mitigate the inherent difficulty of
securing pathogens; enhance response capabilities; reconsider risks and
threats; and revise security and incident response plans as needed.
DHS agreed with the report and has started to implement our
recommendations. USDA stated that the report was very useful.
September 2003
COMBATING BIOTERRORISM
Actions Needed to Improve Security at Plum Island Animal Disease Center
Security at the Plum Island Animal Disease Center has improved, but
fundamental concerns leave the facility vulnerable to security breaches.
First, Plum Island's physical security arrangements are incomplete and
limited. Second, Plum Island officials have been assuming unnecessary
risks by not adequately controlling access to areas where pathogens are
located. Controlling access is particularly important because pathogens
are inherently difficult to secure at any facility. Although this risk may
always exist, DHS could consult with other laboratories working with
pathogens to learn different approaches to mitigate this risk. Third, Plum
Island's security response has limitations. For example, the guard force
has been armed but has not had the authority from USDA to carry firearms
or make arrests. Moreover, Plum Island's incident response plan does not
consider the possibility of a terrorist attack. Fourth, the risk that an
adversary may try to steal pathogens is, in our opinion, higher at the
Plum Island Animal Disease Center than USDA originally determined because
of hostilities surrounding the strike. Also, when USDA developed its
security plan for Plum Island, it did not review their defined threats
with the intelligence community and local law enforcement officials to
learn of possible threats-and their associated risks-relevant to the Plum
Island vicinity. Although these reviews did not occur, USDA subsequently
arranged to receive current intelligence information.
Despite a decline in performance from the previous rating period, USDA
rated the contractor's performance as superior for the rating period
during which the strike occurred.
Plum Island Animal Disease Center
Source: DHS.
www.gao.gov/cgi-bin/getrpt?GAO-03-847
To view the full product, including the scope and methodology, click on
the link above. For more information, contact Larry Dyckman at (202)
512-3841 or [email protected].
Contents
Letter
Results in Brief
Background
USDA Has Taken Strides To Improve Security at Plum Island, but
Fundamental Concerns Remain
USDA Concluded Its Contractor's Performance Declined during the Strike but
Operations Continued and Overall Performance Was Superior
Conclusions
Recommendations for Executive Action
Agency Comments
1 3 6
11
22 22 23 24
Appendixes
Appendix I:
Appendix II:
Appendix III:
Appendix IV: Appendix V: Appendix VI:
Scope and Methodology
Additional Observations on Plum Island's Security System by GAO's Office
of Special Investigations
LB&B Associates' Performance, Employee Qualifications, and Costs
Performance
Employee Qualifications
Costs Attributable to the Strike
Comments from the Department of Homeland Security Comments from the U.S.
Department of Agriculture GAO Contact and Staff Acknowledgments
GAO Contact Acknowledgments 28
30
31 31 34 35
39
43
46 46 46
Table Table 1: Summary of the Award Fee Determination Board's Rating
of LB&B Associates' Performance from April 2002 to
January 2003. 34
Figures Figure 1: Plum Island, New York Figure 2: USDA Award Fee 7
Determination Board's Composite
Scores for LB&B Associates' Performance from October
1999 through January 2003 33
Figure 3: Monthly Costs Billed to USDA, October 2001 through
May
2003 36
Contents
Abbreviations
APHIS Animal and Plant Health Inspection Service
ARS Agricultural Research Service
DHS Department of Homeland Security
FBI Federal Bureau of Investigation
GAO General Accounting Office
USDA U.S. Department of Agriculture
This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed in
its entirety without further permission from GAO. However, because this
work may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this material
separately.
A
United States General Accounting Office Washington, D.C. 20548
September 19, 2003
The Honorable Tom Harkin
Ranking Democratic Member
Committee on Agriculture, Nutrition and Forestry
United States Senate
Dear Senator Harkin:
The Plum Island Animal Disease Center-located in Long Island Sound off
the coast of New York-researches contagious animal diseases that have
been identified in other countries. The mission of the facility is to
develop
strategies for protecting the nation's animal industries and exports from
these foreign animal diseases, which could be accidentally or deliberately
introduced into the United States. Scientists at Plum Island-often with
the assistance of scientists from other countries-identify the pathogens
and toxins (hereafter called pathogens) that cause these foreign animal
diseases and then work to develop vaccines against them. Some of the
pathogens maintained at the Plum Island Animal Disease Center, such as
foot-and-mouth disease, are highly contagious to livestock and could cause
catastrophic economic losses in the agricultural sector if they were
released outside the facility. A few can also cause illness and death in
humans. For this reason, research on these pathogens is conducted within
a sealed biocontainment area that has special safety features designed to
contain the pathogens.
Until recently, the Department of Agriculture (USDA) administered Plum
Island, but in June 2003, it became the responsibility of the Department
of
Homeland Security (DHS).1 DHS officials told us that during a transition
period that will last until September 31, 2003, they will review USDA's
policies and procedures for Plum Island and determine how best to
administer the facility. USDA will continue to have access to the facility
to
perform its research and diagnostic programs.
1The Homeland Security Act of 2002 (P.L. 107-296, S: 310) authorized the
transfer of Plum Island to DHS.
Concerns about security at the Plum Island Animal Disease Center were
heightened after the terrorist attacks of September 11, 2001, because of
fears that someone might try to steal certain pathogens from the facility
to conduct bioterrorist activities. As a result, USDA contracted with
Sandia National Laboratories-experts involved in a range of national
security areas, including ensuring the safety of nuclear weapons-to
evaluate the effectiveness of, and make recommendations to improve, Plum
Island's security program. USDA worked with Sandia to develop a risk
management approach to improve security on the island. Some other agencies
employ this method for their security planning, including the Department
of Energy; we have also endorsed a risk management approach for addressing
security risks.2
Risk management is a deliberate process for determining risk: that is, how
likely it is that a threat will harm an asset and how severe the
consequences would be if the asset were harmed, and then deciding on and
implementing actions to create a certain level of protection or
preparedness. Risk management acknowledges that while risk generally
cannot be eliminated, enhancing protection from known or potential threats
can reduce it. A facility adopting this approach should document in a
security plan the assets the facility is protecting as well as the likely
adversaries and their capabilities (the threat), the probability that an
adversary will attempt to threaten those assets and the consequences of
the adversary succeeding (the risk), and the weaknesses that might allow
an adversary to be successful (the vulnerability). The identified threats,
risks, and vulnerabilities are used to design the physical security
system. Because security systems cannot protect against all threats, the
facility should also develop an incident response plan that clearly lays
out the actions to be taken if an event occurs that exceeds the capability
of the security system. The risk management process is ongoing; as new
information develops or events occur, security is reevaluated and
corrective actions are taken.
In August 2002, congressional concerns about the security of pathogens at
the Plum Island Animal Disease Center arose when 71 employees of the
contractor USDA had hired to operate and maintain the facility, LB&B
Associates Inc., went on strike. You asked us to determine (1) the
adequacy of security at Plum Island and (2) how well LB&B Associates
performed from August 2002, the month that its workers went on strike,
2U.S. General Accounting Office, Homeland Security: A Risk Management
Approach Can Guide Preparedness Efforts, GAO-02-208T (Washington, D.C.:
Oct. 31, 2001).
through January 2003. To address the first question, we visited Plum
Island several times to gain an understanding of the work performed there,
the operation of the facilities, and to examine the security measures and
plans. We also spoke with officials from DHS, USDA, Sandia National
Laboratories, the National Institutes of Health, the U.S. Army Medical
Research Institute of Infectious Diseases, the Central Intelligence
Agency, the Defense Intelligence Agency, the Federal Bureau of
Investigation (FBI), USDA's Office of Inspector General, and government
officials of localities near Plum Island. To address the second question
we, among other things, reviewed LB&B Associates' contract; interviewed
pertinent officials; and reviewed USDA's ratings of LB&B Associates'
performance, the qualifications of its employees to perform certain tasks,
and costs that LB&B Associates incurred, but we did not independently rate
the contractor's performance. Before the administration of Plum Island
transferred to DHS, we briefed USDA and DHS officials on our preliminary
findings and made suggestions for improvement so that they could take
immediate corrective measures. Additional details about our scope and
methodology are contained in appendix I.
Results in Brief Security at the Plum Island Animal Disease Center has
improved, but fundamental concerns remain. Before the September 2001
terrorist attacks, officials at the Plum Island Animal Disease Center were
less conscious of security and focused primarily on the safety of research
activities and operations. Immediately after the attacks, USDA began a
concerted effort to assess security at many of its laboratories, including
Plum Island. Using a risk management approach that Sandia had suggested,
USDA identified certain pathogens as the primary asset requiring
protection, the potential threats to this asset, and the associated risk.
USDA also began steps to upgrade security, some of which DHS has
continued. For example, USDA hired armed guards to patrol the island and
installed fingerprint recognition locks on freezers containing pathogens.
Despite such improvements, we identified shortcomings in Plum Island's
security arrangements.
First, Plum Island's physical security is incomplete and limited. For
example, the alarms and door sensors that Sandia recommended for the
biocontainment area are not fully operational. Our Office of Special
Investigations also identified shortcomings such as inadequate lighting to
support the security cameras outside the research complex. Moreover, USDA
did not provide sufficient physical security for certain assets, including
the foot-and-mouth disease vaccine bank, and assets critical to
the continued operation of the facility. DHS officials agree that alarms
and door sensors for the biocontainment area are important and anticipate
that they will be in place by December 2003. DHS officials also told us
they are in the process of evaluating other physical security decisions
made by USDA. We are recommending actions to correct Plum Island's
physical security deficiencies.
Second, Plum Island officials have not adequately controlled access to the
pathogens. For example, in an effort to continue its mission, USDA
permitted eight scientists from other countries access to the
biocontainment area without being escorted, despite incomplete background
checks. In addition, background checks are not conducted on students who
regularly attend classes within the biocontainment area. According to the
FBI, allowing anyone involved with pathogen-related activities-and, in
particular, scientists from other countries-access to the biocontainment
area without a completed background investigation represents a significant
security risk. Furthermore, not all individuals entering the
biocontainment area for the purpose of performing nonlaboratory functions,
such as cleaning, have been escorted as required by regulations. DHS
officials expressed concerns about this issue and said they are reviewing
USDA policies and practices. Finally, controlling access to the pathogens
is particularly important because no security device is currently capable
of detecting a microgram of pathogenic material. Therefore, a scientist at
Plum Island, or any other laboratory, could remove a tiny quantity of
pathogen without being detected and potentially develop it into a weapon.
This condition is common to all facilities performing biological research.
Although this risk may always exist, DHS could consult with other
laboratories working with pathogens to learn about their different
approaches for mitigating this risk. For example, at the U.S. Army Medical
Research Institute of Infectious Diseases, background checks are required
to be updated regularly to evaluate the continued suitability and
reliability of employees working with pathogens. DHS officials agree that
additional measures could help safeguard the pathogens at Plum Island and
stated that they have taken responsibility for performing background
checks on all scientists prior to being admitted to the biocontainment
area and added escorts. We are recommending actions to further limit
access to pathogens and to identify ways to mitigate the inherent
difficulty of securing pathogens.
Third, Plum Island's incident response capability has limitations. For
example, the guard force on Plum Island has been operating without
authority from USDA to carry firearms or to make arrests. Until this
authority is provided, local law enforcement officials said they are
reluctant to help address criminal situations on the island. In addition,
Plum Island officials have never specified how long they believe it should
take for local law enforcement to respond to incidents. Moreover, Plum
Island's incident response plan does not address what to do in the event
of an incident that exceeds the capability of the security system, such as
a terrorist attack. Finally, Plum Island officials have not tested the
facility's response capability to ensure its effectiveness. DHS officials
said they have started to take actions to fully address these incident
response issues and are obtaining assistance from the Federal Protective
Service. We are recommending that DHS officials enhance Plum Island's
incident response capability.
Fourth, the risk that an adversary might try to steal pathogens is, in our
opinion, higher than USDA believed it to be in 2001, when it defined the
same risks for all of its laboratories, including Plum Island. USDA
considered the risk that an adversary would try to steal pathogens from
any of its laboratories to be relatively low compared to materials found
at other laboratories, such as nuclear material or pathogens of a higher
consequence to the human population. Since that time, however, the level
of risk at Plum Island has increased because of the strike that occurred
in August 2002 and the hostility surrounding it. For example, one striker
has been convicted of tampering with the island's water distribution and
treatment system as he walked off the job the day the strike began. USDA
officials suspect that this individual did not act alone. The intelligence
community considers disgruntled employees to be threats who pose a
security risk. Although USDA did consider the possibility of a disgruntled
worker when planning security for all of its laboratories, it did not
reevaluate the level of risk, the assets requiring protection, or its
incident response plans for Plum Island in light of specific events
related to the strike. Furthermore, Sandia had originally recommended that
USDA review the defined threats with the intelligence community and local
law enforcement officials to ensure that threats particular to Plum Island
and its vicinity were taken into consideration, but this was never done.
FBI and Suffolk County officials told us that they consider this step to
be very important because if there are such threats, federal and local
officials may know of their existence and the risks they pose to the Plum
Island Animal Disease Center. DHS officials told us they recognize the
importance of working with local law enforcement and the intelligence
community in order to better identify the threats relevant for planning
security for Plum Island. We are recommending that DHS reconsider the
risks and threats to Plum Island and revise the security and incident
response plans as needed.
Regarding the contractor's performance, despite a decline from the
previous rating period, USDA rated LB&B Associates' performance as
superior for the rating period during which the strike occurred. Also, as
a result of the strike, LB&B Associates exceeded its estimated budget by
about $511,000, or approximately 5 percent, for fiscal year 2002 and the
first quarter of fiscal year 2003. USDA was aware of and approved the cost
increases.
We provided DHS and USDA with a draft of this report for their review and
comment. Both agencies provided written and clarifying oral comments. The
agencies also provided technical comments, which we incorporated into the
report as appropriate. DHS agreed with the report and stated that it has
started to implement our recommendations. USDA stated that the report was
very useful, but raised several concerns. For example, USDA stated that it
appropriately used armed guards on Plum Island. Our concern is that USDA
employed armed guards without ensuring that they had appropriate authority
from USDA to carry firearms or make arrests. Furthermore, USDA had not
developed a policy for instructing its guards on Plum Island about when
and how they could use force, including the firearms they were carrying.
DHS stated that it is working to resolve these issues.
Background Plum Island is a federally owned 840-acre island off the
northeastern tip of Long Island, New York. It is about 1.5 miles from
Orient Point, New York (see fig. 1), and about 12 miles from New London,
Connecticut. Access to Plum Island is by a ferry service operated by a
contractor that transports employees from Orient Point and Old Saybrook,
Connecticut.
Figure 1: Plum Island, New York
The U.S. Army used Plum Island during World War II as a coastal defense
artillery installation until it was declared surplus property in 1948. In
1952, the U.S. Army Chemical Corps constructed a biological research
laboratory, but it was never used. Then, in response to a foot-and-mouth
disease outbreak in Canada, the Congress transferred all of Plum Island to
USDA in 1954 for the purpose of researching and diagnosing animal diseases
from other countries, including foot-and-mouth disease, which has not been
seen in the United States since 1929.
Foot-and-mouth disease is the most feared foreign animal disease because
it is highly contagious and can have serious effects on the economy.
Slaughtering susceptible animals and quarantining both animals and humans
in affected areas helps limit the spread of the disease, but it can,
nevertheless, have devastating economic consequences, as demonstrated
during the 2001 outbreak in the United Kingdom. By the time the disease
was eradicated, about 8 months later, the United Kingdom had slaughtered
over 4 million animals and sustained losses of over $5 billion in the food
and agricultural industries, as well as comparable losses in tourism.3
Many other types of animal diseases are also studied at the Plum Island
Animal Disease Center, such as classical swine fever; rinderpest; and a
variety of pox viruses, including goat, camel, and deer pox. Some of the
diseases are caused by pathogens that are zoonotic-that is, they can
infect, and possibly cause death, in both animals and humans. Zoonotic
pathogens maintained at Plum Island Animal Disease Center include West
Nile virus, Venezuelan equine encephalitis, Rift Valley fever, and
vesicular stomatitis. Because of the importance of the livestock industry
to the U.S. agricultural sector and economy, protecting livestock from
these diseases is an important responsibility.
To prevent pathogens from escaping the Plum Island Animal Disease Center
and infecting livestock, wildlife, or humans, all research is conducted
within a specially designed and sealed biocontainment area within the
research facility that adheres to specific safety measures.4 For example,
the biocontainment area has air seals on its doors and operates with
negative air pressure so that air passes through a special filter system
3An outbreak directly impacts the trade sector because countries constrain
trade with those markets whose products may be tainted with foot-and-mouth
disease. Other sectors, such as tourism are affected because tourist
activities are restricted, especially in quarantined areas. Production
from infected or quarantined herds is zero because production is stopped
when animals are slaughtered and products from infected animals are not
permitted into the food chain.
4Laboratories adhere to specific biosafety guidelines according to their
designated biosafety level, which can range from 1 to 4. Biosafety level 1
is acceptable for low-risk organisms that may be found, for example, in
high school laboratories. Biosafety level 4 is reserved for a number of
exotic and highly lethal pathogens, such as ebola. There are only five
facilities in the United States with biosafety level 4 laboratories,
including the Department of the Defense's U.S. Army Medical Research
Institute of Infectious Diseases and the Department of Health and Human
Services' National Institutes of Health. Plum Island operates a biosafety
level 3 agriculture laboratory with some additional special agricultural
safety features to prevent the release of animal disease pathogens into
the environment.
before leaving the facility. In addition, employees and visitors must
change into protective clothing before entering the biocontainment area
and shower when going between rooms containing different animal diseases
and before leaving the biocontainment area. USDA's procedures require all
people and material leaving the biocontainment area to be decontaminated.
The Plum Island Animal Disease Center's biocontainment area totals
approximately 190,000 square feet, and it is unusual because it houses a
laboratory facility with 40 rooms for large animals. The three-level
laboratory also contains the machinery, such as the air filtration system,
necessary for the biocontainment area to function, and the pathogen
repository. Individuals entering the biocontainment area have access to
all three floors. In contrast, biocontainment areas of other laboratories
usually consist of a series of smaller rooms, housing smaller laboratory
animals, making it easier to control access to the pathogens.
As a result of the September 11, 2001, terrorist attacks, Plum Island
Animal Disease Center is now required to abide by new laws and regulations
that were generated to help reduce the possibility of bioterrorism. These
laws and regulations limit access to pathogens to only approved
individuals- those whom USDA has identified as having a legitimate need to
handle agents or toxins and whose names and identifying information have
been submitted to and approved by the U.S. Attorney General. Specifically,
the USA Patriot Act of 20015 prohibits restricted people-such as criminals
or those individuals from countries that the Department of State has
declared to be state sponsors of terrorism-from shipping, receiving,
transporting, or possessing certain dangerous pathogens. In addition, the
Agricultural Bioterrorism Protection Act of 20026 requires that USDA
develop an inventory of potentially dangerous pathogens. Furthermore,
individuals who possess or use pathogens must have background checks and
must be registered with the U.S. Attorney General. Implementing this law
are regulations that became effective on February 11, 2003,7 which state
that
5Pub. L. No. 107-56, S: 817. 6Pub. L. No. 107-188, S:S: 211-213. 77 CFR
part 331.
laboratories must be in compliance with the regulations by November 12,
2003. USDA also requires employees to have favorably adjudicated
background investigations before working unescorted in the biocontainment
area.8
When USDA contracted with Sandia in October 2001, Sandia evaluated the
effectiveness of security at the Plum Island Animal Disease Center and
four other USDA laboratories. Using a risk management approach, USDA first
identified generic lists of assets, risks, and threats for all five
laboratories. Sandia then used USDA's generic threat definitions to assess
the security and vulnerabilities at each laboratory. Sandia officials
found that Plum Island's existing security system was inadequate for
protecting against the generic threats that USDA had selected and that it
required significant improvement. Sandia officials also found that the
biocontainment building was not designed to be a highly secure facility.
USDA and Sandia agreed, however, that modifying the facility to withstand
an assault would be cost-prohibitive and that, because pathogens occur
naturally and are available at other laboratories throughout the world,
the risk that a terrorist would try to steal them from Plum Island was not
perceived as significant (and their perception has not changed).
Consequently, Sandia recommended a limited physical security system
designed to deter and detect a security breach and, with assistance from
local law enforcement, respond to incidents exceeding the capability of
the guard force on the island.
DHS assumed formal administration of Plum Island from USDA on June 1,
2003, as provided by the Homeland Security Act of 2002. During a
transition period that will last until October 1, 2003, DHS will review
USDA's policies and procedures and determine how best to administer the
functions of Plum Island. Until the transition is complete, DHS will
administer the facility under the same policies and regulations
established by USDA. Ultimately, the two agencies will work together to
address national biodefense issues and carry out the mission of the Plum
Island Animal Disease Center. While DHS is now formally responsible for
security, scientists and support staff of two USDA agencies, the
Agricultural Research Service (ARS) and the Animal and Plant Health
Inspection Service (APHIS), will continue to implement the Plum Island
Animal Disease Center's research and diagnostic mission. ARS scientists at
Plum Island are responsible for research on foreign livestock diseases,
8USDA Security Policies and Procedures for Biosafety Level-3 Facilities,
Agricultural Research Service, DM 9610-1.
while APHIS scientists are responsible for diagnosing livestock diseases.
APHIS conducts diagnostic training sessions several times a year to give
veterinary health professionals the opportunity to study the clinical
signs of animal diseases found in other countries, such as foot-and-mouth
disease. According to USDA, scientists from other countries are an
integral part of the Plum Island Animal Disease Center's workforce because
they are well qualified and well situated to study the diseases researched
there, many of which are endemic to their own countries. These scientists
are sponsored by USDA and obtain visas that permit them to work for the
department.
DHS currently uses USDA's independent contractor to carry out operations
and maintenance functions for Plum Island. The services under the contract
include, among other activities, operating the ferries, providing security
and emergency fire and medical services, providing buildings and grounds
services, meeting utility requirements, and performing custodial
functions. On August 13, 2002, 71 of these employees went on strike. The
contractor at that time, LB&B Associates, was responsible for handling the
strike. On January 6, 2003, LB&B Associates' contract expired. USDA had
initially awarded that contract under a small business program when LB&B
Associates still qualified as one. Since that initial award, LB&B
Associates had grown so that it no longer was eligible to compete for
contracts set aside for small businesses. As a result, USDA awarded the
new contract to North Fork Services, a joint venture between LB&B
Associates and Olgoonik Logistics LLC, a small minority company of
Anchorage, Alaska. Under this arrangement, the more experienced LB&B
Associates serves as a mentor to North Fork Services, and most of the
employees who worked for LB&B Associates continue to work for North Fork
Services. DHS officials told us that they would not renew the contract
with North Fork Services. DHS stated that the current terms and scope of
the contract are insufficient to operate the facility in accordance with
its view of the standards and mission of the Plum Island Animal Disease
Center.
USDA Has Taken Strides To Improve Security at Plum Island, but Fundamental
Concerns Remain
Before the September 2001 terrorist attacks, the Plum Island Animal
Disease Center, like many other federal laboratories, was less conscious
of security and focused primarily on the safety of its programs and
operations. Since then, USDA intensified its focus on security and has
taken strides in developing and installing a security system. However,
Plum Island remains vulnerable to security breaches because its security
arrangements are incomplete and limited.
USDA Has Taken Strides To Improve Security at Plum Island
Security at Plum Island has improved since the fall of 2001. USDA hired a
physical security specialist to oversee its efforts to improve security,
including the implementation of Sandia's recommendations, and to provide
direction for the security measures being taken for Plum Island. 9 As of
July 2003, completed security upgrades include the following:
o taking measures to prevent unauthorized access to Plum Island by
allowing only sponsored visitors on the ferry and island; identifying
those sponsored individuals, and allocating passes, when they board the
ferry; and staffing Orient Point, New York, with a security guard as well
as installing an access gate that can be opened only with an
identification card assigned to Plum Island federal personnel;
o hiring armed guards to patrol the island and observe personnel and
visitors entering and leaving the facility. When the nation is on high
terrorist alert (code orange) armed guards are added to monitor access to
the biocontainment area and to better secure the island's perimeter. This
also allows armed guards to remain in the building while the other armed
guards go to the harbor to inspect vehicles unloaded from the ferry and
ensure that individuals departing the ferry onto Plum Island have
permission to be there;
o conducting a background check for government staff and contractors
working on the island and performing more rigorous checks for individuals
with access to the pathogens;
o installing some video cameras to (1) increase the probability of timely
detection of an intruder and (2) monitor the activities of those inside
the biocontainment area when they remove pathogens from the storage
area-or the repository;
o installing intrusion detection alarms in the administrative building
and the biocontainment area;
9Also, USDA had engaged the U.S. Army Corps of Engineers in August 2000 to
make some physical security improvements at Plum Island, but this work was
not based on an assessment of threats and risks. Few of the measures
suggested by the Corps were implemented. In addition, Sandia officials
told us that they did not agree with the approach taken by the Corps and
that their physical security recommendations differed significantly. USDA
has relied on Sandia's security recommendations.
o limiting access to pathogens by installing certain access control
devices; and
o improving pathogen control and accountability by completing and
maintaining an inventory of pathogens at the facility, submitting names of
those with access to pathogens to the U.S. Attorney General, and creating
security and incident response plans, as required by law.
Despite Improvements, Security Arrangements at Plum Island Are Incomplete
and Have Serious Limitations
Plum Island's Physical Security Is Incomplete and Limited
Although security at the Plum Island Animal Disease Center has improved
over the past few years, fundamental concerns remain.
Plum Island's physical security system is not yet fully operational. For
example, the facility does not yet have in place all the equipment
necessary to detect intruders in various places. DHS officials agree that
these physical security measures are important and anticipate they will be
in place by December 2003.
In addition, our Office of Special Investigations identified physical
security limitations. For example, we found that lighting is inadequate to
support the cameras outside of the research complex and vehicles are not
properly screened. (See app. II for other limitations identified by our
Office of Special Investigations and observations on how they could be
addressed.)
Moreover, the physical security measures that USDA chose to implement on
Plum Island are largely limited to the biocontainment area, where
pathogens are located. Consequently, other important assets remain
vulnerable. For example, the continued operation of the Plum Island Animal
Disease Center is dependent on its infrastructure, which has limited
protection. Protecting the infrastructure is particularly important
because the Plum Island Animal Disease Center is the only facility in the
United States capable of responding to an outbreak and researching
foot-and-mouth disease. Therefore, if the infrastructure was damaged, no
other facility could step in and continue this foot-and-mouth disease
work. 10
10Foot-and-mouth disease cannot be studied on the mainland of the United
States unless the Secretary of Agriculture determines that it is necessary
to do so (see 21 U.S.C. S: 113a).
Furthermore, Plum Island is the only facility in North America that has a
foot-and-mouth disease vaccine bank. This bank represents years of
cooperative research performed by Canada, Mexico, and the United States,
yet the room containing it has a window opening covered with only plywood.
USDA officials said they intend to improve the physical security of the
vaccine bank but have not yet decided on the approach to take. In
addition, DHS officials agree that the Plum Island Animal Disease Center
is vital to combating bioterrorism, and they are evaluating the physical
security on Plum Island.
Access to Pathogens Is Not Access to pathogens at the Plum Island Animal
Disease Center is not
Adequately Controlled adequately controlled. For example, as of July 2003,
eight scientists from other countries were working in the biocontainment
area without completed background investigations.11 According to FBI
officials, allowing anyone who does not have a completed background
investigation access to the biocontainment area-in particular, a scientist
from another country-represents a significant security risk. USDA
officials told us these scientists were allowed into the biocontainment
area to enable research to continue. Furthermore, they stated that
background investigations had been initiated for these individuals, and it
was assumed that these scientists were being escorted, which USDA policy
permits for those with pending background investigations. However, Plum
Island officials told us that due to resource constraints, it has not been
possible to continually escort and monitor scientists while they are in
the biocontainment area. When we brought this concern to the attention of
DHS officials, they told us they are developing a more restrictive policy
for allowing scientists from other countries to have access to pathogens.
11USDA officials told us that they considered these scientists to be
"grandfathered"-that is, USDA did not require background checks to gain
unescorted access because these scientists were employed before enactment
of the Bioterrorism Preparedness Act in June 2002. In addition, we found
that three of these scientists arrived after this date-December 2002 and
February and May 2003.
In addition, USDA policy does not require background checks on students
who attend the foot-and-mouth disease classes that are regularly held in
the biocontainment area. In 2002, USDA held six classes with an average of
32 students per class and anticipates continuing these classes in the
future. According to USDA's policy, individuals may enter the
biocontainment area without background checks if an approved individual
escorts them.12 We believe this policy warrants reconsideration for
several reasons.
o Allowing students who do not have background checks into biocontainment
for purposes of attending foot-and-mouth disease classes, with or without
an approved escort, may not be consistent with the regulations13
implementing the Agricultural Bioterrorism Preparedness Act.
o These same regulations do not provide an exception for unapproved
students or other visitors who may be handling or have access to
pathogens.
o USDA officials told us that maintaining constant visual contact with
even one escorted individual is very difficult because of the size and
floor plan of the biocontainment area.
USDA officials told us that they believe escorting students is sufficient
to meet the intent of the regulations. However, DHS officials said that
all students should have completed background checks before entering the
biocontainment area and told us they will develop a policy that will
ensure that this occurs once the transition period is complete.
Although USDA's regulations specifically allow unapproved individuals into
the biocontainment area with an approved escort, we found unescorted
maintenance workers in the biocontainment area. The regulations provide
for unapproved individuals to conduct routine cleaning, maintenance,
repair, and other nonlaboratory functions in the biocontainment area if
they are escorted and continually monitored by an approved individual.14
However, early in our investigation we found that as many as five such
12USDA Security Policies and Procedures for Biosafety Level 3-Facilities,
Agricultural Research Service, DM 9610-1.
137 CFR S:S: 331.10 and 331.11.
147 CFR S: 331.10(a)(2)(iv)(B).
individuals were working in the biocontainment area without escorts. When
we brought this to the attention of USDA officials, they provided an
escort for these individuals. DHS officials added that the operating
contractor would soon provide security escorts.
Controlling access to pathogens is important because no security device
can currently ensure that an insider, such as a scientist, will not steal
pathogens from the Plum Island Animal Disease Center or other
laboratories. According to the director of the Plum Island Animal Disease
Center-while under USDA's administration-and officials from Sandia, the
National Institutes of Health, and the U.S. Army Medical Research
Institute of Infectious Diseases, pathogens are more difficult to secure
than other materials that could be used as weapons, such as nuclear
material. This is because there is no existing mechanism capable of
detecting the theft of a microgram of pathogenic material and a tiny
quantity can be multiplied. Thus, a scientist could covertly generate or
divert a pathogen during the normal course of work, remove it from the
laboratory undetected, and potentially develop it into a weapon for
spreading disease. This inherent problem leaves all facilities with
pathogens vulnerable to serious security breaches. Also, the existence of
the foot-and-mouth disease pathogen at the Plum Island Animal Disease
Center is a particular concern because an undetected theft, followed by
the spread of the disease, would have serious economic consequences for
the nation. In addition, the presence of zoonotic diseases at the Plum
Island Animal Disease Center is worrisome because of the potential for
adverse health affects on humans, and two such pathogens are of particular
concern. First, U.S. government research has shown that Venezuelan equine
encephalitis virus can be developed into a human biowarfare agent. Second,
USDA believes that because of the genetic similarities of two pox strains,
it may be possible to manipulate camel pox into an agent as threatening as
smallpox.15 Although USDA created an inventory list of the pathogens at
the Plum Island Animal Disease Center, as required by law, such a list
cannot provide an accurate count of pathogens because quantities of
pathogens change as they replicate.
Thus far, Plum Island officials have secured pathogens by restricting
access to the island itself and to the biocontainment area where the
pathogens are
15Out of concern that Iraqi scientists were trying to manipulate camel pox
for possible warfare use, USDA conducted work for the Department of
Defense to determine if camel pox could be manipulated into an agent
similar to smallpox.
located and by locking the freezers containing the pathogens. But DHS
officials have not yet had the opportunity to fully consider actions other
laboratories are taking to mitigate the likelihood that pathogens could be
stolen. Officials at the U.S. Army Medical Research Institute of
Infectious Diseases at Fort Detrick, Maryland, told us they are taking
several steps, in addition to physical security measures and inventory
control, to better safeguard pathogens against theft. For example, they
plan to use trained personnel as roving monitors to ensure that
unauthorized laboratory work is not being performed, and they will
randomly inspect all personnel exiting laboratories. Moreover, they are
interviewing scientists periodically and requiring that background checks
be updated every 5 years in order to evaluate the continued suitability
and reliability of those employees working with pathogens. Although USDA
told us background checks were updated every 5 years, according to Plum
Island records as of July 2003, 12 current Plum Island employees, some of
whom have access to pathogens, had not had their background checks updated
in more than 10 years. According to Sandia, other potentially helpful
safeguards include creating, implementing, and enforcing strict policies,
including those that prohibit researchers from continuing work in the
biocontainment area if they do not follow security procedures. DHS
officials stated that they have started to work with other laboratories
and that measures such as these, while not necessarily a panacea, could
help improve the security of pathogens at Plum Island.
Incident Response Capability Is Plum Island's incident response capability
is limited in four ways. First, the
Limited security guards on each shift carry firearms, although Plum Island
does not have statutory authority for an armed guard force.16 USDA
operated the guard force on Plum Island without authority for the guards
to carry firearms or make arrests. Furthermore, Plum Island officials have
not approved a policy that addresses the use of weapons, and, as a result,
the guards do not know specifically how they are expected to deal with
intruders on the island and when or if they should use their weapons.17
16USDA's Office of General Counsel was aware of this issue for over 1 year
but had not resolved it as of June 2003 when DHS became responsible for
Plum Island.
17A draft policy on the use of force was written for the guard force on
Plum Island but never put into use.
When we informed DHS officials of these problems, they agreed to resolve
them as soon as possible and raised the possibility that the Federal
Protective Service18 could be assigned to guard Plum Island. The Federal
Protective Service, now under DHS, has the authority to carry weapons and
make arrests.19 Since DHS has taken responsibility for the island, the
Federal Protective Service has visited Plum Island to assess its security
requirements.
Second, according to the observations of our Office of Special
Investigations, Plum Island has too few guards to ensure safety and
effectiveness.20 DHS officials agree with this observation and said that
they have requested funds to hire additional guards.
Third, arrangements for local law enforcement support are also limited.
According to Sandia's recommended security plan, in the event an incident
exceeds the response capability of the Plum Island guards, they would
first contact Southold town police, the closest and primary responding law
enforcement agency.21 If still more resources were needed, Southold town
police would contact Suffolk County police, the secondary responder.
Because of liability issues, however, arrangements with local law
enforcement have not been finalized even though there have been continuing
discussions with local law enforcement. The result is that Plum Island
officials cannot predict the extent to which the Southold town police will
provide backup during an incident. On the other hand, officials of Suffolk
County, which includes both Plum Island and Southold, told us that
although it takes longer for them to respond than Southold police, they
could respond with an adequate number of officers, if necessary.22 In
addition, they have requested a map of the island and a tour of the
biocontainment area to become more knowledgeable about the facility and
18The Federal Protective Service's goal is to provide a safe environment
in which federal agencies can conduct their business by reducing threats
posed against federal facilities, which range from terrorism to workplace
violence to larcenies.
19Under the Homeland Security Act of 2002, DHS has authority for its
officers to carry firearms and make arrests.
20Additional observations of our Office of Special Investigations are
included in appendix II.
21Southold town police are located on Long Island in Suffolk County,
approximately 5 miles from Plum Island.
22In a life-and-death situation, the Suffolk County Police Department
could respond with a helicopter, significantly reducing response time.
its surrounding terrain. Suffolk County officials pointed out, however,
that, for geographical reasons, Southold remains the primary responder. In
this vein, Plum Island officials have never defined an adequate response
time, nor have they conducted exercises with local law enforcement
officials to determine how effectively Plum Island and local officials can
address an incident on the island. DHS officials agree that the
arrangements for local law enforcement support are limited, and they are
trying to overcome this problem as quickly as possible by first resolving
the issue surrounding the authority to make arrests and carry weapons. In
addition, these officials concur that it is important to develop a better
understanding of the response times and capabilities of local law
enforcement assistance and to conduct exercises to test the adequacy of
arrangements once they are completed.
Fourth, according to Sandia officials, the incident response plan for Plum
Island is not sufficiently comprehensive. Plum Island's incident response
plan contains certain elements required under law, such as how to respond
to an inventory violation or a bomb threat. 23 However, because USDA
selected a risk management approach to security, Plum Island officials
need an incident response plan that clearly lays out the actions to be
taken if events occur that exceed the capability of the facility's
security system. For example, Plum Island officials do not have a road map
for actions to be taken in the event of a terrorist attack-who gets
notified, in what order, and the responsibilities of staff for responding.
This is a critical shortcoming because, according to DHS, the nation faces
a significant risk of a terrorist attack. Sandia officials also said that
the incident response plan for Plum Island requires significant additional
development to properly prepare for the complete range of threats.
Moreover, the incident response plan does not identify the security steps
that should be taken in the event of an outbreak of foot-and-mouth disease
or take into consideration any increased risks to the facility, which
could severely impede the nation's capability to contain an outbreak.
23See 7 CFR, S: 331.11 (a) (3).
Finally, according to the FBI and local law enforcement officials, the
island's incident response plan may need to be coordinated with the
incident response plans of such nearby facilities as the Millstone nuclear
power plant, the Brookhaven National Laboratory, and the laboratories at
the State University of New York at Stony Brook because a terrorist attack
on any of these facilities could also involve Plum Island.24 This type of
coordination has not yet taken place. DHS officials agree that the
incident response plan needs to be more comprehensive and coordinated with
national and local law enforcement agencies.
Plum Island's Security Plan Does The risk that an adversary might try to
steal pathogens is, in our opinion, Not Address All Risks and higher than
USDA believed it to be in 2001, when it defined the same risks
Threats
for all of its laboratories, including Plum Island. USDA considered the
risk that an adversary would try to steal pathogens from any of its
laboratories to be relatively low compared to materials found at other
laboratories, such as nuclear material or pathogens of a higher
consequence to the human population. Since its evaluation in 2001,
however, the level of risk at Plum Island has increased because of the
strike that occurred in August 2002 and the hostility surrounding it. For
example, one striker has been convicted of tampering with the island's
water distribution and treatment system as he walked off the job the day
the strike began.25 USDA officials suspect that this individual did not
act alone. In addition to this incident, USDA asked the FBI and USDA's
Office of Inspector General to investigate the possibility that a boat
engine had been tampered with. USDA also asked the FBI to investigate why
backup generators failed to come on when Plum Island lost power for more
than 3 hours in December 2002.
24Officials of the FBI's New York office and of the Suffolk County's
Police Department and Department of Fire, Rescue and Emergency Service
told us that they would welcome the opportunity to review Plum Island's
security assessment and response plans and would assist with this
coordination.
25Water pressure is a vital component of the process used to decontaminate
materials in the biocontainment area in order to prevent the spread of
animal diseases. Convicted of malicious mischief for tampering with the
water system, the employee was sentenced to 5 years' probation and ordered
to pay restitution.
After the backup generators failed to provide power, New York's ABC news
station broadcast an interview with a disguised worker, at that time
employed at Plum Island, who discussed his unhappiness with USDA and the
contractor and blamed replacement workers for the power outage.26 In
addition, several of the striking workers returned to work for LB&B
Associates and are still employed on the island under the new contractor,
North Fork Services. In response to the strike, USDA prevented striking
workers from accessing Plum Island and it added guards at Orient Point to
assure the security of employees as they were arriving and departing near
the union picket line. However, USDA did not reevaluate the level of risk,
the assets requiring protection, or its incident response plans in light
of the strike and accompanying sabotage. USDA believed that this was not
necessary because its security plan anticipated a disgruntled worker at
any of its laboratories. We disagree because there is a difference between
addressing security problems caused by one employee and addressing the
hostilities resulting from the strike, which could include several
employees working together. We believe that the implications of a
disgruntled work force should be taken into account when reevaluating the
extent of risks, threats, and assets requiring increased security.
Furthermore, Sandia had originally recommended that USDA review the
defined threats with the intelligence community and local law enforcement
officials to ensure that threats particular to Plum Island and its
vicinity were taken into consideration, but this was never done.27 FBI and
Suffolk County officials told us that they consider this step to be very
important because if there were such threats, federal and local officials
may be aware of them and the risks they pose to the Plum Island Animal
Disease Center. In addition, if local law enforcement entities were
involved in planning Plum Island's security, they would be in a better
position to respond to incidents on the island.
DHS officials agree that rehiring workers who walked off the job could be
problematic but told us they are under pressure from the local chapter of
the union and the community to rehire those who lost their jobs as a
result of the strike. DHS officials also said they recognize the
importance of
26USDA officials said that although it was never proven that replacement
workers were to blame for the outage, this illustrates the discontent on
the island. Information on the qualifications of replacement workers can
be found in appendix III.
27While intelligence officials did not contribute to the assessment of
threats to Plum Island, USDA has established links that provide current
information about terrorist threats.
working with local law enforcement and the intelligence community to
better define the threats and associated risks for Plum Island.
USDA Concluded Its Contractor's Performance Declined during the Strike but
Operations Continued and Overall Performance Was Superior
Regarding the contractor's performance, despite a decline from the
previous rating period, USDA rated LB&B Associates' performance as
superior for the rating period during which the strike occurred. When the
strike occurred, LB&B Associates, with the assistance of USDA employees,
maintained operations at Plum Island. For example, LB&B Associates
implemented a strike contingency plan, brought in qualified individuals
from its other work sites, and hired subcontractors with the required
licenses and certifications to operate certain Plum Island facilities and
its boats. Also, as a result of the strike, LB&B Associates exceeded its
estimated budget by about $511,000, or approximately 5 percent, for fiscal
year 2002 and the first quarter of fiscal year 2003. USDA was aware of and
approved the cost increases. Further information about LB&B Associates'
performance, employee qualifications, and costs is contained in appendix
III.
Conclusions Despite improvements, security arrangements at Plum Island are
not yet sufficient. Further actions are needed to provide reasonable
assurance that pathogens cannot be removed from the facility and exploited
for use in bioterrorism. Until DHS fully implements the physical security
measures and addresses those vulnerabilities identified by our Office of
Special Investigations, Plum Island's security system will not provide
physical security commensurate with the importance of the facility.
Additionally, the Plum Island Animal Disease Center will remain more
vulnerable than it needs to be if the physical infrastructure that
supports it is not afforded better protection. Similarly, it is important
to better secure the foot-and-mouth disease vaccine bank to ensure its
availability for combating an outbreak. Also, the lack of comprehensive
policies and procedures for limiting access to pathogens unnecessarily
elevates the risk of pathogen theft. Moreover, because physical security
measures alone are not adequate to secure pathogens, all laboratories
containing these materials face the challenge of developing other
approaches to mitigate the risk of theft. By consulting with other
laboratories to discover methods they are using to mitigate the risk to
pathogens, Plum Island officials can learn more about safeguards being
employed elsewhere. Furthermore, Plum Island officials cannot effectively
respond to security breaches until DHS resolves issues that impede Plum
Island's response capability, such as the authority
of the guard force to make arrests, which makes it difficult for the
guards and local law enforcement agencies to address criminal situations
on the island. Finally, because we believe the level of risk at Plum
Island is higher than USDA originally determined, and because USDA did not
validate threats with intelligence agencies or local law enforcement
officials, DHS cannot be assured that Plum Island's security, including
its physical security system and response plans, is sufficient to address
the full range of events that could occur on the island.
Recommendations for Executive Action
To complete and enhance Plum Island's security arrangements, we recommend
that the Secretary of Homeland Security, in consultation with the
Secretary of Agriculture, do the following:
o Correct physical security deficiencies by (1) fully implementing the
physical security measures, (2) addressing the specific security
shortcomings identified by our Office of Special Investigations, (3)
better securing certain features of the physical infrastructure that
supports the continued operation of the Plum Island Animal Disease Center,
and (4) better securing the foot-and-mouth disease vaccine bank.
o Limit access to pathogens by further developing and enforcing specific
procedures, including internal control checks, to ensure (1) that all
individuals involved in laboratory activities in the biocontainment
area-including students and regardless of citizenship-have been approved,
in accordance with the law; (2) that background checks of these
individuals are updated regularly; and (3) that cleaning, maintenance, and
repair staff entering the biocontainment area are escorted at all times by
individuals with completed background checks.
o Consult with other laboratories to identify ways to mitigate the
inherent difficulty of securing pathogens.
o Enhance incident response capability by (1) resolving the issue of the
guards' authority to carry firearms and make arrests; (2) developing and
implementing a policy on how guards should deal with intruders and use
weapons; (3) increasing the size of the guard force; (4) completing an
agreement with local law enforcement agencies to ensure backup assistance
when needed; (5) defining an adequate response time for law enforcement to
respond to incidents; (6) developing an incident response plan that
includes precise detail about what to do in the event
an incident occurs that exceeds the capability of the security system,
such as a terrorist attack; and (7) conducting exercises with local law
enforcement to test the efficiency and effectiveness of Plum Island's
response capability.
o Reconsider the security risks at Plum Island, taking into account
recent acts of disgruntled employees.
o Consult with appropriate state and local law enforcement and
intelligence agencies to revisit the threats specific to the Plum Island
Animal Disease Center.
o Revise, as necessary, security and incident response plans to reflect
any redefined, risks, threats, and assets.
Agency Comments We provided DHS and USDA with a draft of this report for
their review and comment. Both agencies provided written and clarifying
oral comments. The agencies also provided technical comments, which we
incorporated into the report as appropriate. Overall, DHS agreed with the
report and stated that it has started to implement our recommendations,
and USDA stated that the report was very useful but also raised several
concerns.
In its written comments (see app. IV), DHS agreed that fundamental
concerns leave the facility vulnerable to security breaches and stated
that the report is factually accurate. DHS also commented that it accepts
and supports our recommendations. In addition, DHS stated that since it
assumed administrative responsibility for Plum Island on June 1, 2003, it
has taken the following actions, among others, to address the
recommendations in this report:
o DHS is working with USDA to develop corrective actions to address the
physical security deficiencies identified in our report.
o DHS is working with USDA to develop an access control policy for all
personnel who are required to enter the biocontainment area.
o DHS is working with other federal agencies to develop security policies
and procedures to limit access to pathogens.
o DHS is working with the Federal Protective Service to enhance security
at the facility and bring arrest and detention authority to the island. In
addition, DHS stated that funds have been requested to increase the guard
force.
o DHS is working with local law enforcement agencies to coordinate
incident response plans, mutual aid agreement requirements, and joint
exercises to test security response capabilities.
o DHS is reviewing the island's entire security plan and will revise the
threat assessment as necessary. DHS stated that it expects to complete
this assessment in early 2004.
In its written comments (see app. V), USDA addressed several aspects of
our report. These specific comments and our responses follow.
o USDA suggested that the report should make judgments about the need for
enhanced security against a risk assessment-based approach that considers
both the probability and the consequences of specific types of attacks.
However, as we report, DHS is now responsible for performing such an
assessment, and DHS stated that it has undertaken a review of USDA's
threat statement, which it will complete early in 2004. Our objective was
to evaluate the status of security on Plum Island. That evaluation
included, among other steps, a review of USDA's risk-based security plan
for Plum Island and its implementation. Our report details substantive
flaws in both the planning and the execution of that plan.
o USDA also commented that the report did not recognize that USDA had a
contract to improve security at Plum Island prior to September 11, 2001.
We added to the report that USDA contracted with the U.S. Army Corps of
Engineers in 2000 to improve security at Plum Island, but noted that few
of the Corps' recommendations had been implemented. Also, USDA officials
told us that in light of September 11, 2001, and the subsequent
dissemination of anthrax through the postal system, they made a concerted
effort to improve security at USDA's laboratories. The officials added
that Sandia was hired to provide USDA with a consistent approach to
evaluating security at the department's major laboratories. Sandia
officials told us that they did not agree with the approach taken by the
Corps, and they concluded that Plum Island's existing security system was
substantially inadequate for protecting against the threats that USDA
defined as relevant.
o USDA indicated that it took various actions to safeguard pathogens in
response to the strike. USDA stated that it increased and armed the
guards on Plum Island; added guards at Orient Point, Long Island, where
the strikers were picketing; and excluded the strikers from Plum Island
facilities. We agree that USDA responded with immediate measures and have
revised the report to reflect these steps. However, we believe that USDA's
responses to the strike were insufficient. Although USDA increased the
number of guards at Orient Point, this was a temporary measure primarily
put in place to ensure the safety of the employees as they passed the
union picket line. Also, Plum Island officials told us that the number of
guards on Plum Island itself did not change as a result of the strike and
that these guards had been armed since 2001. More importantly, USDA's
comments do not recognize that there is a difference between addressing
security problems caused by one employee and addressing the security
problems resulting from the strike, which could include several employees
collaborating to cause problems. We believe that the implications of
having a disgruntled work force should be taken into account when
reevaluating the extent of risks, threats and assets requiring increased
security.
o USDA stated that it appropriately used armed guards on Plum Island and
were in communication with local law enforcement. While we agree that
armed guards are necessary for security on Plum Island, our concern is
that the guard force did not have authority from USDA to carry firearms
and make arrests. Furthermore, USDA never developed a policy instructing
its guards when and how they could use force, including the firearms they
were carrying. Plum Island officials said they were unable to resolve
these important matters with USDA headquarters officials, including the
Office of General Counsel. Finally, we noted in the report that while Plum
Island officials have communicated with local law enforcement, no
agreement was reached to assist Plum Island guards in the event a criminal
act occurred on the island. DHS stated that it is working to resolve these
issues.
o USDA stated that it is an accepted practice for a person with an
appropriate background investigation to escort those who do not yet have a
clearance. USDA also acknowledged that it had problems implementing its
escort procedures at Plum Island but now believes its escort procedures
are reliable. We agree that the practice of escorting is used in other
laboratories that contain pathogens. However, Plum Island officials and
scientists repeatedly told us that this procedure is not practical at Plum
Island because of staffing considerations. For example, they explained
that the escorts were Plum Island employees who had other duties, which
compelled them to leave those they were
escorting for periods of time. Furthermore, we believe that internal
control checks should be established to ensure implementation of escort
procedures, and we have added this to our recommendations. DHS commented
that more will be done to address this issue-it is planning to develop, in
concert with USDA, a limited use policy to identify access control
requirements for all personnel who are required to enter the
biocontainment area.
o USDA said that several of the employees we identified had not had their
background checks updated in the last 5 years, but that some of those we
identified had. We reported based on the actual records of background
checks maintained at the Plum Island Animal Disease Center. We also
recognize that there may be differences between the records maintained on
the island and other USDA records, and that the background checks of
several of these individuals may have been updated since the time of our
review.
As we agreed with your office, unless you publicly announce the contents
of this report earlier, we plan no further distribution of it until 30
days from the date of this report. We will then send copies of this report
to the Secretaries of Homeland Security and Agriculture, appropriate
congressional committees, and other interested parties. We will also make
copies available at no charge on the GAO Web site at http://www.gao.gov.
If you have any questions about this report, please call me or Charles M.
Adams at (202) 512-3841. Key contributors to this report are listed in
appendix VI.
Sincerely yours,
Lawrence J. Dyckman Director, Natural Resources
and Environment
Appendix I
Scope and Methodology
To determine the extent to which USDA has addressed security for Plum
Island, we visited the facility several times to examine current physical
security measures and to review plans for further security actions. In
addition, two security experts from our Office of Special Investigations
toured the facility to identify possible vulnerabilities and actions that
could be taken to reduce them. We also reviewed numerous security
documents, such as Sandia's assessment of Plum Island security; Plum
Island's draft security and response plans; draft memorandums of
understanding with local entities; physical security implementation plans;
and policies and procedures for guards, employees, visitors, students, and
others with access to pathogens. In addition, we worked closely with
Sandia officials to understand how they applied a risk management security
approach to Plum Island. We also interviewed numerous officials from Plum
Island, including the physical security specialist, scientists, the center
director, and others responsible for security changes under both the
Agricultural Research Service and the Animal Plant and Health Inspection
Service; officials of USDA's Offices of Homeland Security, Procurement and
Property Management, and General Counsel; and officials of the Department
of Homeland Security, which assumed the administration of Plum Island. To
gain a better understanding of possible threats to Plum Island, we spoke
with officials from the Federal Bureau of Investigation, Defense
Intelligence Agency, Central Intelligence Agency, Suffolk County police
and fire departments, and USDA's Office of Inspector General. To
understand the cooperation between local governments and Plum Island that
might be needed if an incident were to occur on the island, we interviewed
government and law enforcement officials from Suffolk County, the town of
Southold, and the village of Greenport. Finally, we toured the
laboratories at and interviewed officials from the National Institutes of
Health and the U.S. Army Medical Research Institute of Infectious Diseases
to understand how they are handling security challenges since the
terrorist attacks of 2001. To determine Plum Island's compliance with new
laws and regulations, we reviewed the USA Patriot Act1 of 2001, the
Agricultural Bioterrorism Protection Act of 20022 and its regulations that
went into effect as a final interim rule on February 11, 2003,3 as well as
USDA's policies and procedures for security at biosafety level 3
facilities. We also considered the Office of Management and
1Pub. L. No. 107-56.
2Pub. L. No. 107-188 S: S: 211-213.
37 CFR S: 331.
Appendix I
Scope and Methodology
Budget's Circular A-123, Management Accountability and Control,4 and the
standards in our Internal Control: Standards for Internal Control in the
Federal Government.5
To determine how well LB&B Associates performed from the time the strike
began on August 13, 2002, to January 5, 2003, we (1) reviewed LB&B
Associates' contract with USDA and identified LB&B Associates' performance
requirements; (2) interviewed officials of USDA, LB&B Associates, and the
International Union of Operating Engineers to get their perspective on
LB&B Associates' performance; (3) reviewed USDA's ratings of LB&B
Associates' performance since 1999 and, in particular, the Award Fee
Determination Board's report on LB&B Associates' performance during the
period the strike took place; (4) reviewed the qualifications of LB&B
Associates employees, such as the boat operators and water distribution
and treatment system operators, all of whom are required to meet certain
qualifications for performing their duties; (5) analyzed 3 years of
contract cost data provided by LB&B Associates to learn which items
increased as a result of the strike; and (6) validated the contract cost
data by spot-checking it against the bills LB&B Associates submitted to
USDA. While we took these steps to determine how well LB&B Associates
performed, we did not independently rate LB&B Associates' performance. In
addition, we interviewed officials involved in investigating
strike-related incidents, including officials of the Federal Bureau of
Investigation and USDA's Office of Inspector General.
Our work was conducted in accordance with generally accepted government
auditing standards from January through August 2003.
4Office of Management and Budget, OMB Circular A-123 Management
Accountability and Control (Washington, D.C.: 1995). This document
provides the specific requirements for assessing and reporting on controls
within the executive branch.
5U.S. General Accounting Office, Internal Control: Standards for Internal
Control in the Federal Government, GAO/AIMD-00-21.3.1 (Washington, D.C.:
November 1999). The Federal Managers' Financial Integrity Act of 1982
(FMFIA) requires us to issue standards for internal control in government.
Among other things, the standards provide the overall framework for
establishing and maintaining internal control.
Appendix II
Additional Observations on Plum Island's Security System by GAO's Office
of Special Investigations
o The security force reports directly to the Administrative Contract
Officer and not to the Security Director-it is important for the security
force to report directly to the Security Director of Plum Island to ensure
that security-related issues are handled promptly.
o There are no name checks or record checks given to contractors and
visitors going into the biocontainment area. Contractors and visitors
entering the biocontainment area could be checked for criminal charges
(through the National Criminal Information Center) before they are granted
access.
o The area outside of the biocontainment and administrative building is
surveilled by stationary closed-circuit television cameras, which are
insufficient. Installing pan, tilt, and zoom closed-circuit television
cameras in certain areas would enhance surveillance capabilities.
o The island is easily accessible to the general public by boat, and
there are limited "no trespassing" signs present on the island to advise
the public that it is a government facility-more "no trespassing" signs in
those areas of the island that are easily accessible to the public by boat
would address this condition.
o In the event of a fire, Plum Island is not always able to respond
appropriately because the fire brigade has limited hours of operation. The
security force could be cross-trained for fire rescues and therefore
provide 24-hour coverage.
o The building used for overnight accommodations lacks panic alarms for
emergency response. Panic alarms could be installed in the building and,
when visitors are present, security guards could drive by on a regular
basis.
o Control for keys and master keys of the facility is deficient. The
security department could be assigned the responsibility for all keys and
master keys. A key log could be created to better track possession of
keys.
Appendix III
LB&B Associates' Performance, Employee Qualifications, and Costs
USDA concluded, in an evaluation of LB&B Associates' performance, which
included the time period involving the strike, that LB&B Associates'
overall performance was superior, although its performance had declined
compared to prior rating periods. When the strike occurred, LB&B
Associates, with the assistance of USDA employees, continued to perform
and maintained operations at Plum Island. LB&B Associates implemented a
strike contingency plan, brought in qualified individuals from its other
work sites, and hired subcontractors with the required licenses and
certifications to operate certain Plum Island facilities and its boats.
Also, as a result of the strike, LB&B Associates exceeded its estimated
budget by about $511,000, or approximately 5 percent, for fiscal year 2002
and the first quarter of fiscal year 2003. USDA was aware of and approved
the cost increases.
Performance Although LB&B Associates' performance declined during the
strike relative to previous rating periods, overall, LB&B Associates
performed at a superior level during the evaluation period that included
several months when workers were on strike, maintaining-and in some cases
even improving-operations critical to the functioning of the island,
according to Plum Island officials. Plum Island's Award Fee Determination
Board regularly rated LB&B Associates' performance using a system
described in its contract to calculate a composite performance score.1
According to the board, LB&B Associates' performance was outstanding-the
highest level-for more than 2 years, until the rating period in which the
strike began. The board faulted LB&B Associates in several rating
categories resulting in a decline in its performance rating. For example,
according to the board, LB&B Associates' strike contingency plan, which
describes how essential operations would be continued in the event of a
strike, was outdated. As a result, implementation of the plan was slowed
because it took up to 48 hours before all of its temporary workers arrived
on the island. Moreover, some subcontracts cost more than anticipated.
According to the board, LB&B Associates overcame initial problems in
implementing its contingency plan and, overall, performed at the superior
1The Award Fee Determination Board consisted of six officials who worked
on Plum Island: center director, assistant center director, administrative
contract officer, safety officer, APHIS laboratory chief, and ARS
foot-and-mouth disease unit scientist. The composite score could have
placed LB&B at one of five levels: 0-34, unacceptable; 35-49,
unsatisfactory; 50-70, satisfactory; 71-84, superior; and 85-100,
outstanding.
Appendix III
LB&B Associates' Performance, Employee
Qualifications, and Costs
level. For example, temporary workers and subcontractors hired by LB&B
Associates quickly repaired the water system that had been sabotaged on
the first day of the strike. Furthermore, according to the board, some
activities improved after the onset of the strike, including the
maintenance of steam pipes, an important component of the process used to
decontaminate laboratory waste contaminated with pathogens. Also, boat
maintenance and cafeteria services-both of which, according to the Board,
had been problematic before the strike-improved after replacement workers
were hired. Figure 2 shows the composite scores the board gave LB&B
Associates from fiscal year 2000 through the first quarter of fiscal year
2003, which includes the time during which the strike occurred.
Appendix III
LB&B Associates' Performance, Employee
Qualifications, and Costs
Figure 2: USDA Award Fee Determination Board's Composite Scores for LB&B
Associates' Performance from October 1999 through January 2003
Note: GAO presentation of USDA data.
aUSDA rated LB&B Associates quarterly through fiscal year 2000; USDA
changed to a 6-month rating schedule beginning with fiscal year 2001.
bThe strike began in August of this rating period, April 1, 2002, through
January 5, 2003, which would have ended on September 30, 2002; however,
because the contract was extended through January 2003, the rating period
was extended also.
More details about how the board evaluated LB&B Associates' performance
are contained in table 1.
Appendix III
LB&B Associates' Performance, Employee
Qualifications, and Costs
Table 1: Summary of the Award Fee Determination Board's Rating of LB&B
Associates' Performance from April 2002 to January 2003.
Performance Score and level of categories Types of activities performance
Utilities o Heating, A/C, and ventilation 77
o Refrigeration Superior
o Plumbing and pipefitting
o Power plant operations
o Wastewater operations
o Electronics
Safety, health and o Security 70
environmental o Emergency health Satisfactory
services
compliance o Environmental
compliance
o Biological safety
o Fire alarm support
Program and cost o Contract and cost 80
management
management o Special task management Superior
o Resource utilization
o Quality control
o Subcontract management
o Scheduling and
coordination
o Communications and
reporting
Facilities o Painting and carpentry 76
o Equipment maintenance Superior
o Janitorial functions
o General building and grounds
maintenance
Administrative o Photography services 82
support o Mail Superior
o Laundry
o Glassware
o Food services
Transportation o All marine and vehicle 71 transportation services
Superior
o Boat and vehicle maintenance
Source: GAO.
Note: GAO presentation of USDA data.
Employee To maintain operations at Plum Island after the strike began,
LB&B Associates brought in temporary replacements from some of its other
Qualifications contract sites, hired subcontractors, and subsequently
hired permanent replacement workers, as described in the strike
contingency plan. We confirmed that workers in certain positions,
including boat operators and operators for the wastewater treatment
system, were licensed as
Appendix III
LB&B Associates' Performance, Employee
Qualifications, and Costs
prescribed by LB&B Associates' contract with USDA. In addition, many of
the replacement workers appear to have significant and relevant work
experience for the positions for which they were hired.
Although LB&B Associates and USDA staff worked together to maintain vital
functions, operations were affected at times by the strike because of the
reduced workforce and the loss of some workers with specific skills and/or
qualifications. For example, the ferries that take workers to and from the
island operated on a reduced schedule until all three boat masters who had
walked out were replaced by individuals with the necessary Coast Guard
license. Also, some USDA officials stepped in to fulfill duties that were
normally performed by qualified contract staff, such as monitoring the air
filters in the laboratory, until qualified replacements were hired. By
July 2003, most positions left vacant by the strike were filled, most of
them by permanent replacement workers and 16 by striking workers who
returned to work on the island.
Costs Attributable to the Strike
With USDA's approval, LB&B Associates exceeded its estimated budget by
about $511,000, or approximately 5 percent, during the 15-month period
covering fiscal year 2002 and the first quarter of fiscal year 2003,2 the
period during which the strike began.3 USDA allowed the additional
expenditures, which occurred in the last 2 months of fiscal year 2002 and
the first 3 months of 2003, because it recognized that the strike would
result in higher expenses and it found LB&B Associates' estimate for
exceeding the budget to be acceptable, under the circumstances. As
required by Federal Acquisition Regulations, LB&B Associates notified USDA
that it expected
2LB&B Associates exceeded its fiscal year 2002 estimated budget of
$8,027,011 by approximately $151,000, or about 1.9 percent. In the first
quarter of fiscal year 2003, which covered October 1, 2002, through
January 5, 2003, the contractor exceeded the estimated budget of
$2,250,524 by about $360,000, or about 16 percent.
3Prior to the strike, LB&B Associates billed to USDA over $107,000 in
legal fees associated with renewing the collective bargaining agreement
through May 31, 2002, after which time LB&B Associates itself paid about
$136,000 in legal fees through April 2003.
Appendix III
LB&B Associates' Performance, Employee
Qualifications, and Costs
to exceed its budget as a result of the strike.4 Figure 3 shows the total
costs LB&B Associates charged to USDA from October 1, 2001 through January
5 2003; the graph also incorporates costs billed to USDA by North Fork
Services from January 6 through May 31, 2003, illustrating the continued
fluctuation in contract costs.
Figure 3: Monthly Costs Billed to USDA, October 2001 through May 2003
Note: GAO presentation of USDA data.
4Under a cost-reimbursable contract, Federal Acquisition Regulations
require that the contractor notify the agency in writing whenever it has
reason to believe that its costs will exceed 75 percent of the estimated
budget, or if the total cost will be greater or significantly less than
the estimated budget. Also, as part of the notification process, the
contractor is required to provide the agency with a revised estimate of
the total cost of performing its contract. In this case, if USDA had not
accepted the cost increases, USDA officials said that USDA and LB&B
Associates officials would have had to agree on which services to
discontinue in order to stay on budget.
Appendix III
LB&B Associates' Performance, Employee
Qualifications, and Costs
According to LB&B Associates' data,5 there were fluctuations in Plum
Island's costs, as shown in figure 3. Also, as a result of the strike,
additional costs were incurred in the following areas from August 1, 2002,
through January 5, 2003,6 unless otherwise noted: labor (salary and
benefits), subcontracts, cafeteria, and travel (including lodging and
transportation).
Labor: The cost of labor peaked at $428,161 in August 2002, a 16 percent
increase over the average monthly cost of $370,118 for the previous 10
months. Monthly labor costs then gradually decreased until November, when
the cost of labor was about 1.6 percent more than the average monthly
cost. Labor costs increased because most of the temporary replacements
were management-level employees from other LB&B Associates contract sites,
who earned more than the employees they replaced. According to its
documents, LB&B Associates used management-level employees because union
members from other localities usually honor a picket line and would not
temporarily replace union strikers. As new permanent employees were hired,
the cost of labor gradually decreased.
Subcontracts: Subcontracts related to the strike, such as for providing
security guards at the picket line, added about $523,000,7 or 77 percent
of the total subcontract costs billed to USDA by LB&B Associates.
Cafeteria: Cafeteria expenses increased by about $12,000, or 51 percent of
the total cafeteria expenses because the cafeteria provided two meals per
day for the temporary replacements, who spent more time on the island to
ensure continued operations than employees had before the strike began.
5An independent auditor found that LB&B Associates' statements of income,
changes in equity, and cash flows fairly represent the financial position
of the company for the fiscal year ending September 30, 2002.
6Costs rose sharply in December 2002 because costs related to subcontracts
that were incurred in October and November were not billed to USDA until
December, due to the billing cycles of LB&B Associates and the
subcontractors. These subcontract-related costs were for tasks unrelated
to the strike, such as security guards on the island, and related to the
strike, such as security guards at the picket line.
7North Fork Services incurred an additional $36,000 in subcontract costs
related to the strike from January 6 through May 31, 2003. These
subcontracts were for delivering supplies and materials to Orient Point
and for security at the picket line on Orient Point while striking workers
were picketing.
Appendix III
LB&B Associates' Performance, Employee
Qualifications, and Costs
Travel: Travel expenses attributed to the strike, such as transporting and
housing the temporary replacement workers, totaled more than $125,000,
constituting 98 percent of the total travel costs billed to USDA during
that time period.
Appendix IV
Comments from the Department of Homeland Security
Appendix IV
Comments from the Department of Homeland
Security
Appendix IV
Comments from the Department of Homeland
Security
Appendix IV
Comments from the Department of Homeland
Security
Appendix V
Comments from the U.S. Department of Agriculture
Appendix V
Comments from the U.S. Department of
Agriculture
Appendix V
Comments from the U.S. Department of
Agriculture
Appendix VI
GAO Contact and Staff Acknowledgments
GAO Contact Charles M. Adams, (202) 512-8010
Acknowledgments In addition to the individual named above, Aldo Benejam,
Nancy Crothers, Mary Denigan-Macauley, Jonathan Gill, Thomas Farrell,
Wyatt R. Hundrup, and Ramon Rodriguez made key contributions to this
report.
GAO's Mission The General Accounting Office, the audit, evaluation and
investigative arm of Congress, exists to support Congress in meeting its
constitutional responsibilities and to help improve the performance and
accountability of the federal government for the American people. GAO
examines the use of public funds; evaluates federal programs and policies;
and provides analyses, recommendations, and other assistance to help
Congress make informed oversight, policy, and funding decisions. GAO's
commitment to good government is reflected in its core values of
accountability, integrity, and reliability.
Obtaining Copies of GAO Reports and Testimony
The fastest and easiest way to obtain copies of GAO documents at no cost
is through the Internet. GAO's Web site (www.gao.gov) contains abstracts
and full-text files of current reports and testimony and an expanding
archive of older products. The Web site features a search engine to help
you locate documents using key words and phrases. You can print these
documents in their entirety, including charts and other graphics.
Each day, GAO issues a list of newly released reports, testimony, and
correspondence. GAO posts this list, known as "Today's Reports," on its
Web site daily. The list contains links to the full-text document files.
To have GAO e-mail this list to you every afternoon, go to www.gao.gov and
select "Subscribe to e-mail alerts" under the "Order GAO Products"
heading.
Order by Mail or Phone The first copy of each printed report is free.
Additional copies are $2 each. A check or money order should be made out
to the Superintendent of Documents. GAO also accepts VISA and Mastercard.
Orders for 100 or more copies mailed to a single address are discounted 25
percent. Orders should be sent to:
U.S. General Accounting Office 441 G Street NW, Room LM Washington, D.C.
20548
To order by Phone: Voice: (202) 512-6000 TDD: (202) 512-2537 Fax: (202)
512-6061
To Report Fraud, Contact: Web site: www.gao.gov/fraudnet/fraudnet.htm
Waste, and Abuse in E-mail: [email protected]
Federal Programs Automated answering system: (800) 424-5454 or (202)
512-7470
Public Affairs Jeff Nelligan, Managing Director, [email protected] (202)
512-4800 U.S. General Accounting Office, 441 G Street NW, Room 7149
Washington, D.C. 20548
Presorted Standard
Postage & Fees Paid
GAO
Permit No. GI00
United States
General Accounting Office
Washington, D.C. 20548-0001
Official Business
Penalty for Private Use $300
Address Service Requested
*** End of document. ***