Homeland Security: Federal Action Needed to Address Security
Challenges at Chemical Facilities (23-FEB-04, GAO-04-482T).
The events of September 11, 2001, triggered a national
re-examination of the security of thousands of industrial
facilities that use or store hazardous chemicals in quantities
that could potentially put large numbers of Americans at risk of
serious injury or death in the event of a terrorist-caused
chemical release. GAO was asked to examine (1) available
information on the threats and risks from terrorism faced by U.S.
chemical facilities; (2) federal requirements for security
preparedness and safety at facilities; (3) actions taken by
federal agencies to assess the vulnerability of the industry; and
(4) voluntary actions the chemical industry has taken to address
security preparedness, and the challenges it faces in protecting
its assets and operations. GAO issued a report on this work in
March 2003 (GAO-03-439).
-------------------------Indexing Terms-------------------------
REPORTNUM: GAO-04-482T
ACCNO: A09337
TITLE: Homeland Security: Federal Action Needed to Address
Security Challenges at Chemical Facilities
DATE: 02/23/2004
SUBJECT: Facility security
Hazardous substances
Health hazards
Industrial facilities
Industrial safety
National preparedness
Proposed legislation
Safety regulation
Terrorism
Voluntary compliance
Chemicals
Risk assessments
******************************************************************
** This file contains an ASCII representation of the text of a **
** GAO Product. **
** **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced. Tables are included, but **
** may not resemble those in the printed version. **
** **
** Please see the PDF (Portable Document Format) file, when **
** available, for a complete electronic file of the printed **
** document's contents. **
** **
******************************************************************
GAO-04-482T
United States General Accounting Office
GAO Testimony
Before the Subcommittee on National Security, Emerging Threats, and
International Relations, Committee on Government Reform, House of
Representatives
For Release on Delivery Expected at 9:30 a.m. EST
Monday, February 23, 2004 HOMELAND SECURITY
Federal Action Needed to Address Security Challenges at Chemical Facilities
Statement of John B. Stephenson, Director Natural Resources and Environment
GAO-04-482T
February 2004
Highlights of GAO-04-482T, a testimony before the Committee on Government
Reform, Subcommittee on National Security, Emerging Threats, and
International Relations, House of Representatives
The events of September 11, 2001, triggered a national re-examination of
the security of thousands of industrial facilities that use or store
hazardous chemicals in quantities that could potentially put large numbers
of Americans at risk of serious injury or death in the event of a
terrorist-caused chemical release. GAO was asked to examine (1) available
information on the threats and risks from terrorism faced by U.S. chemical
facilities; (2) federal requirements for security preparedness and safety
at facilities; (3) actions taken by federal agencies to assess the
vulnerability of the industry; and (4) voluntary actions the chemical
industry has taken to address security preparedness, and the challenges it
faces in protecting its assets and operations. GAO issued a report on this
work in March 2003 (GAO-03-439).
GAO's March 2003 report recommended that the Secretary of Homeland
Security and the Administrator of EPA jointly develop a comprehensive
national chemical security strategy that is both practical and cost
effective, which includes assessing vulnerabilities to terrorist attacks
and enhancing security preparedness.
Legislation is now before Congress that, if enacted, would direct DHS, or
DHS and EPA, to adopt most of GAO's March 2003 recommendations.
www.gao.gov/cgi-bin/getrpt?GAO-03-439.
To view the full report, including the scope and methodology, click on the
link above. For more information, contact John B. Stephenson at (202)
512-3841 or [email protected].
HOMELAND SECURITY
Federal Action Needed to Address Security Challenges at Chemical Facilities
Chemical facilities may be attractive targets for terrorists intent on
causing economic harm and loss of life. Many facilities exist in populated
areas where a chemical release could threaten thousands. The Environmental
Protection Agency (EPA) reports that 123 chemical plants located
throughout the nation could each potentially expose more than a million
people if a chemical release occurred. To date, no one has comprehensively
assessed the security of chemical facilities.
No federal laws explicitly require that chemical facilities assess
vulnerabilities or take security actions to safeguard their facilities
from attack. However, a number of federal laws impose safety requirements
on facilities that may help mitigate the effects of a terrorist-caused
chemical release. Although EPA believes that the Clean Air Act could be
interpreted to require security at certain chemical facilities, the agency
has decided not to attempt to require these actions in light of the
litigation risk and importance of an effective response to chemical
security. Ultimately, no federal oversight or third-party verification
ensures that voluntary industry assessments of vulnerability are adequate
and that security vulnerabilities are addressed.
Currently, the federal government has not comprehensively assessed the
chemical industry's vulnerabilities to terrorist attacks. EPA, the
Department of Homeland Security (DHS), and the Department of Justice have
taken preliminary steps to assist the industry in its preparedness
efforts, but no agency monitors or documents the extent to which chemical
facilities have implemented security measures. Consequently, federal,
state, and local entities lack comprehensive information on the
vulnerabilities facing the industry.
To its credit, the chemical manufacturing industry, led by its industry
associations, has undertaken a number of voluntary initiatives to address
security at facilities. For example, the American Chemistry Council, whose
members own or operate approximately 1,000, or 7 percent, of the
facilities subject to Clean Air Act risk management plan provisions,
requires its members to conduct vulnerability assessments and implement
security improvements. The industry faces a number of challenges in
preparing facilities against attacks, including ensuring that all chemical
facilities address security concerns. Despite the industry's voluntary
efforts, the extent of security preparedness at U.S. chemical facilities
is unknown. In October 2002 both the Secretary of Homeland Security and
the Administrator of EPA stated that voluntary efforts alone are not
sufficient to assure the public of the industry's preparedness.
Legislation is now pending that would mandate chemical facilities to take
security steps to protect against the risk of a terrorist attack.
Mr. Chairman and Members of the Subcommittee:
Thank you for the opportunity to discuss our work on the security of the
nation's chemical facilities and the recommendations that we made to
address this issue in our March 2003 report.1
As the events of September 11, 2001, showed, terrorists can cause enormous
damage to our country by attacking infrastructure essential to our economy
and jeopardizing public health and safety. Following these events, the
President, in the National Strategy for Homeland Security, identified the
chemical industry as one of 13 sectors critical to the nation's
infrastructure. Across the nation, thousands of industrial facilities
manufacture, use, or store hazardous chemicals in quantities that could
potentially put large numbers of Americans at risk of injury or death in
the event of a chemical release.
Even before September 11, 2001, protecting chemical facilities was the
shared responsibility of federal, state, and local governments in
partnership with the private sector. However, attention was focused
largely on the risks of accidental, rather than intentional, chemical
releases. Under the Clean Air Act, the Environmental Protection Agency
(EPA) identified 140 toxic and flammable chemicals that pose the greatest
risk to human health and the environment when present in certain
quantities above threshold levels. According to EPA, approximately 15,000
facilities in a variety of industries produce, use, or store one or more
of these chemicals beyond threshold amounts. Under the act, these
facilities must take steps to prevent and prepare for an accidental
chemical release, including developing risk management plans (RMP). These
facilities are referred to as RMP facilities. The events of September 11,
2001, brought heightened attention to security at chemical facilities and
the possibility of a chemical release caused by a terrorist attack.
The federal government's role in protecting chemical facilities from
terrorist attacks has been much debated since September 11, 2001.
Initially, EPA had the lead responsibility for chemical security;
currently the Department of Homeland Security (DHS) is the lead federal
agency. For both agencies, public debate has centered on whether the
federal
1U.S. General Accounting Office, Homeland Security: Voluntary Initiatives
Are Under Way at Chemical Facilities, but the Extent of Security
Preparedness Is Unknown, GAO-03-439 (Washington, D.C.: Mar. 14, 2003).
government should impose security requirements on chemical facilities or
whether voluntary industry actions are sufficient. Several legislative
proposals have been introduced that address security measures at chemical
facilities, including provisions giving DHS, or EPA and DHS, authority to
mandate security measures at chemical facilities.
My remarks today will focus on security preparedness at the nation's
chemical facilities. In particular I will (1) summarize available
information on the threats and risks from terrorism that U.S. chemical
facilities face; (2) describe federal requirements for security
preparedness and the safe management of chemicals at these facilities; (3)
describe actions federal agencies have taken to assess the vulnerability
of the chemical industry or to address security preparedness; and (4)
describe voluntary actions the chemical industry has taken to address
security preparedness, and the challenges it faces in protecting its
assets and operations. Our 2003 report was based on our review of
available reports, statutes and regulations, and industry association
documents; interviews with officials from the Department of Defense, the
Department of Justice, EPA, industry associations including the American
Chemistry Council (ACC) and the Synthetic Organic Chemical Manufacturers
Association (SOCMA), and other chemical industry officials; and selected
chemical facility site visits. We limited our review to stationary
chemical facilities and did not address security concerns surrounding
transportation of hazardous chemicals.2 Appendix I provides additional
information on the processes covered under the Clean Air Act's for RMP
facilities, by industry sector, and the residential population surrounding
RMP facilities that could be threatended by a "worst-case" accidental
chemical release.
Summary In summary, experts agree that the nation's chemical facilities
may be attractive targets for terrorists intent on causing massive damage,
but the extent of security preparedness since the events of September 11,
2001, is unknown. The risk of an attack varies among facilities depending
upon several factors, including their location and the types of chemicals
they use, store, or manufacture. No specific data exist on the actual
effects of successful terrorist attacks on chemical facilities. However,
according to
2For information on the transportation of hazardous material, see U.S.
General Accounting Office, Rail Safety and Security: Some Actions Already
Taken to Enhance Rail Security, but Risk-based Plan Needed, GAO-03-435
(Washington, D.C.: April 2003) and U.S. General Accounting Office,
Transportation Security: Federal Action Needed to Help Address Security
Challenges, GAO-03-843 (Washington, D.C.: June 2003).
EPA data on accidental toxic release "worst-case" scenarios, 123 chemical
facilities located throughout the nation could each potentially expose
more than one million people in the surrounding area if a toxic release
occurred. Approximately 700 facilities could each potentially threaten at
least 100,000 people in the surrounding area, and about 3,000 facilities
could each potentially threaten at least 10,000 people. To date, no one
has comprehensively assessed the security of chemical facilities; however,
numerous studies and media accounts of reporters and environmental
activists gaining access to facilities indicate that vulnerabilities
exist.
Unlike water treatment facilities and nuclear power facilities, chemical
facilities are not subject to any federal requirements to assess and
address security vulnerabilities against terrorist attacks. However, a
number of federal laws impose safety requirements that may help mitigate
the effects of a chemical release resulting from a terrorist attack. A
case in point is the Clean Air Act's requirements that RMP facilities take
safety precautions to detect and minimize the effects of accidental
releases, as well as provide prompt emergency response to a release.
Although EPA believes the Clean Air Act could be interpreted to require
security actions at RMP facilities, the agency has decided not to attempt
to require these actions in light of the litigation risk and importance of
an effective response to chemical security. In addition, under the
regulations for the Maritime Transportation Security Act of 2002, vessels
and port facilities- some of which are chemical facilities-must develop
security plans. However, no federal oversight or third-party verification
ensures that voluntary industry assessments of vulnerability are adequate
and that security vulnerabilities are addressed.
Currently, the federal government has not comprehensively assessed the
chemical industry's vulnerability to terrorist attacks. As a result,
federal, state, and local entities lack comprehensive information on the
vulnerabilities the industry faces. However, federal agencies have taken
some preliminary steps to assist the industry in its preparedness efforts.
For example, EPA has issued warning alerts to the industry and informally
visited about 30 high-risk facilities to learn about and encourage
security efforts. According to EPA officials, EPA has provided information
to DHS about the 15,000 facilities and DHS is currently identifying
high-risk facilities and conducting site visits. In May 2002, Justice
submitted an interim report to Congress that described observations on
security at 11 chemical manufacturing facilities. As we reported in
October 2002, however, Justice has not prepared a more comprehensive final
report to Congress on the industry's vulnerabilities, which it was
required by law to deliver in August 2002. In a February 2003 conference
report on Justice's
appropriations, Congress directed that funding be transferred to DHS for
completing vulnerability assessments at chemical facilities.
Finally, although the chemical industry has undertaken a number of
initiatives to address security concerns, the extent of security
preparedness across the chemical industry is unknown. The American
Chemistry Council-whose 145 member companies own or operate approximately
1,000 (7 percent) of the 15,000 RMP facilities-now requires, as a
condition of membership, that facilities conduct security vulnerability
assessments and implement security improvements. EPA officials estimate
that voluntary initiatives led by industry associations only reach a
portion of the 15,000 RMP facilities. Moreover, the industry faces a
number of challenges in preparing facilities against terrorist attacks,
including ensuring that facilities obtain adequate information on threats
and determining the appropriate security measures given the level of risk.
In October 2002, both the Secretary of Homeland Security and the
then-Administrator of EPA stated that voluntary efforts alone are not
sufficient to assure the public of the industry's preparedness. They also
stated that they would support bipartisan legislation to require the
15,000 chemical facilities nationwide that contain large quantities of
hazardous chemicals to comprehensively assess their vulnerabilities and
then act to reduce them.
In light of the challenges facing the industry and the gravity of the
potential threat, we recommended in March 2003 that the Secretary of
Homeland Security and the Administrator of EPA jointly develop a
comprehensive national strategy for chemical security that is both
practical and cost effective. This national strategy should
o identify high-risk facilities based on several factors, including the
level of threat, and collect information on industry security
preparedness;
o specify the roles and responsibilities of each federal agency
partnering with the chemical industry;
o develop appropriate information-sharing mechanisms; and
o develop a legislative proposal, in consultation with industry and
other appropriate groups, to require these chemical facilities to
expeditiously assess their vulnerability to terrorist attacks and, where
necessary, require these facilities to take corrective action.
Legislation is now before Congress that, if enacted, would direct DHS, or
DHS and EPA, to adopt most of these recommendations.
Background
Chemical facilities manufacture a host of products-including basic organic
chemicals, plastic materials and resins, petrochemicals, and industrial
gases, to name a few. Other facilities, such as fertilizer and pesticide
facilities, pulp and paper manufacturers, water facilities, and
refineries, also house large quantities of chemicals. EPA has a role in
preventing and mitigating accidental releases at chemical facilities
through, among other things, the RMP provisions of the Clear Air Act.
Under these provisions, EPA identified 140 toxic and flammable chemicals
that, when present above certain threshold amounts, would pose the
greatest risk to human health and the environment if released. According
to EPA, approximately 15,000 facilities in a variety of industries
produce, use, or store one or more of these chemicals beyond threshold
amounts.
The 2003 President's National Strategy for the Physical Protection of
Critical Infrastructures and Key Assets sets forth actions that EPA and
DHS will take to secure the chemical infrastructure. The strategy directs
EPA and DHS to promote enhanced site security at chemical facilities and
review current practices and statutory requirements on the distribution
and sale of certain pesticides and industrial chemicals to help identify
whether additional measures are necessary. DHS is also charged with
continuing to develop the Chemical Sector Information Sharing and Analysis
Center, a partnership with industry to facilitate the collection and
sharing of threat information, by promoting the Center and recruiting
chemical industry constituents to participate. A presidential directive
issued in December 2003 designates DHS as the lead federal agency for
chemical security, a change from national strategies issued in July 2002
and February 2003, which named EPA as the lead.
A number of other critical infrastructures have federal security
requirements. All commercial nuclear power facilities licensed by the
Nuclear Regulatory Commission are subject to a number of security
requirements. The Aviation and Transportation Security Act of 2001
directed the Transportation Security Administration to take over
responsibility for airport screening. The Public Health Security and
Bioterrorism Preparedness and Response Act of 2002 requires community
water systems serving more than 3,300 people to conduct a vulnerability
assessment, prepare an emergency response plan, certify to EPA that the
vulnerability assessment and emergency response plan have been completed,
and provide a copy of the assessment to EPA. To improve security in our
nation's ports, the regulations implementing the Maritime
Transportation Security Act of 2002 direct vessels and facilities-some of
which are chemical facilities-to develop security plans.3
Congress is considering several legislative proposals that would grant
DHS, or DHS and EPA, the authority to require chemical facilities to take
security steps. S. 994 requires the Secretary of Homeland Security to
promulgate regulations specifying which facilities should be required to
conduct vulnerability assessments and to prepare and implement site
security plans, a timetable for completing the vulnerability assessments
and security plans, the contents of plans, and limits on the disclosure of
sensitive information. S. 157 would direct EPA to designate high-priority
chemical facilities based on the threat posed by an unauthorized release
and require these facilities to conduct vulnerability assessments,
identify hazards that would result from a release, and prepare a
prevention, preparedness, and response plan. S. 157 would also require
facilities to send these assessments and plans to EPA. EPA and DHS would
jointly review the assessments and plans to determine compliance. S. 157
would also require that facilities consider inherently safer practices
(referred to as inherently safer technologies), such as substituting less
toxic chemicals.
Experts agree that chemical facilities present an attractive target for
terrorists intent on causing massive damage because many facilities house
toxic chemicals that could become airborne and drift to surrounding areas
if released. Chemical facilities could also be attractive targets for the
theft of chemicals that could be used to create a weapon capable of
causing harm. Justice has concluded that the risk of an attempt in the
foreseeable future to cause an industrial chemical release is both real
and credible. In fact, according to Justice, domestic terrorists plotted
to use a destructive device against a U.S. facility that housed millions
of gallons of propane in the late 1990s. In testimony on February 6, 2002,
the Director of the Central Intelligence Agency warned of the potential
for an attack by al Qaeda on chemical facilities.
Some chemical facilities may be at higher risk of a terrorist attack than
others because they contain large amounts of toxic chemicals and are
located near population centers. Attacks on such facilities could harm a
An Attack Against Chemical Facilities Could Cause Economic Harm and Loss of
Life
3In responding to our draft, EPA noted that approximately 2,000 RMP
facilities may be covered under the Public Health Security and
Bioterrorism Preparedness and Response Act of 2002.
large number of people, with health effects ranging from mild irritation
to death, cause large-scale evacuations, and disrupt the local or regional
economy. No specific data are available on what the actual effects of
successful terrorist attacks on chemical facilities would be. However, RMP
facilities must submit to EPA estimates, including the residential
population located within the range of a toxic gas cloud produced by a
"worst-case" chemical release, called the "vulnerable zone." According to
EPA, 123 chemical facilities located throughout the nation have toxic
"worst-case" scenarios where more than one million people could be at risk
of exposure to a cloud of toxic gas.4 About 600 facilities could each
potentially threaten between 100,000 and a million people, and about 2,300
facilities could each potentially threaten between 10,000 and 100,000
people within these facilities' "vulnerable zones."
According to EPA, "worst-case" scenarios do not consider the potential
causes of a release or how different causes or other circumstances, such
as safety features, could lessen the consequences of a release. Hence, the
"worst-case" scenario calculations would likely be overstating the
potential consequences. However, under the Clean Air Act, RMP facilities
must estimate the effects of a toxic chemical release involving the
greatest amount of the toxic chemical held in a single vessel or pipe-not
the entire quantity on site. Therefore, for some facilities it is
conceivable that an attack where multiple chemical vessels were breached
simultaneously could result in an even larger release, potentially
affecting a larger population than estimated in the RMP "worst-case"
scenarios. Other factors besides location and the quantity of chemicals
onsite could also make a facility a more attractive target. For example, a
facility that is widely recognizable, located near a historic or iconic
symbol, or critical to supporting other infrastructures could be at higher
risk. A 2002 Brookings
4"Vulnerable zones" are determined by drawing a circle around a facility
with the radius of the circle equal to the distance a toxic gas cloud
would travel before dissipating to relatively harmless levels. Because, in
an actual event, the toxic cloud would only cover a fraction of that
circle, it is unlikely that the event would actually result in exposure of
the entire population estimated in the "worst-case" scenario, according to
EPA. The number of persons within a "vulnerable zone" is larger than the
number of persons that would be affected by a "worst-case" scenario. In
addition, EPA's requirements for "worst-case" release analysis tend to
result in consequence estimates that are significantly higher than what is
likely to actually occur. For example, "worst-case" release analysis does
not take into account active mitigation measures facilities often employ
to reduce the consequences of releases.
No Federal Requirements Specifically Require Chemical Facilities to Address
the Threat of Terrorism
Institution report ranks an attack on toxic chemical facilities behind
only biological and atomic attacks in terms of possible fatalities.5
Currently, no one has comprehensively assessed security across the nation
at facilities that house chemicals. According to a 1999 study by the
Department of Health and Human Services' Agency for Toxic Substances and
Disease Registry (ATSDR), security at chemical facilities in two
communities was fair to very poor. ATSDR observed security vulnerabilities
such as freely accessible chemical barge terminals and chemical rail cars
parked near residential areas in communities where facilities are located.
Following visits to 11 chemical facilities, Justice concluded that some
facilities may need to implement more effective security systems and
develop alternative means to reduce the potential consequences of a
successful attack. The ease with which reporters and environmental
activists gained access to chemical tanks and computer centers that
control manufacturing processes at chemical facilities in recent years
also raises doubts about security effectiveness at some facilities.
No federal laws explicitly require all chemical facilities to take
security actions to safeguard their facilities against a terrorist attack.
Although the federal government requires certain chemical facilities to
take security precautions directed to prevent trespassing or theft, these
requirements do not cover a wide range of chemical facilities and may do
little to actually prevent a terrorist attack. For example, under EPA's
regulations implementing the Resource Conservation and Recovery Act of
1976, facilities that house hazardous waste generally must take certain
security actions, such as posting warning signs and using a 24-hour
surveillance system or surrounding the active portion of the facility with
a barrier and controlled entry gates.6 However, according to EPA, these
requirements would be applicable to only approximately 21 percent of the
15,000 RMP facilities. Regulations implementing the Maritime
Transportation Security Act of 2002 also require vessels and port
facilities-some of which are chemical facilities-to develop security
plans.
5The Brookings Institution, Protecting the American Homeland: A
Preliminary Analysis, (Washington, D.C.: 2002).
640 C.F.R. S: 264.14.
A number of federal laws also impose safety requirements on chemical
facilities, but these requirements do not specifically and directly
address security preparedness against terrorism. Several statutes,
including the Occupational Safety and Health Act, the Clean Air Act, and
the Emergency Planning and Community Right-to-Know Act, impose safety and
emergency response requirements on chemical facilities that may
incidentally reduce the likelihood and mitigate the consequences of
terrorist attacks.7 All of these requirements could potentially mitigate a
terrorist attack in a number of ways. First, because some of these
requirements only apply to facilities with more than threshold quantities
of certain chemicals, facility owners have an incentive to reduce or
eliminate these chemicals, which may make the facility a less attractive
target or minimize the impact of an attack. Second, both the Clean Air Act
risk management plan provisions and the hazard analyses under the
Occupational Safety and Health Act require facility operators to identify
the areas of their facilities that are vulnerable to a chemical release.
When facilities implement measures to improve the safety of these areas,
such as installing sensors and sprinklers, the impact of a
terrorist-caused release may be lessened. Third, the emergency response
plans increase preparedness for a chemical release-whether intentional or
unintentional. While these safety requirements could mitigate the effects
of a terrorist attack, they do not impose any security requirements, such
as conducting vulnerability assessments and addressing identified
problems.
While no law explicitly requires facilities to address the threat of
terrorism, EPA believes that the Clean Air Act could be interpreted to
provide it with authority to address site security from terrorist attacks
at chemical facilities. Section 112(r) of the Clean Air Act-added by the
Clean Air Act Amendments of 1990-imposes certain requirements on chemical
facilities with regard to "accidental releases." The act defines an
accidental release as an unanticipated emission of a regulated substance
or other extremely hazardous substance into the air. Arguably, any
chemical release caused by a terrorist attack would be unanticipated and
thus could be covered under the Clean Air Act. An interpretation of an
unanticipated emission as including an emission due to a terrorist attack
would provide EPA with authority to require security measures or
vulnerability assessments with regard to terrorism. However, EPA has not
7We focus our discussion in this testimony on those requirements dealing
with assessments of hazards and emergency response. However, the Toxic
Substances Control Act also may mitigate the consequences of a terrorist
attack by limiting or eliminating certain toxic chemicals that a facility
manufactures or uses.
Federal Agencies Have Not Comprehensively Assessed the Vulnerability of the
Chemical Industry to Terrorism, but Have Taken Some Preliminary Steps
attempted to use these Clean Air Act provisions. EPA is concerned that
such an interpretation would pose significant litigation risk. As we
reported in March 2003, there are a number of practical and legal
arguments against this interpretation. We find that EPA could reasonably
interpret its Clean Air Act authority to cover chemical security, but also
agree with the agency that this interpretation could be open to
challenges. At the time of our 2003 review, EPA supported passage of
legislation to specifically address chemical security.
Despite a congressional mandate to do so, the federal government has not
conducted the assessments necessary to develop comprehensive information
on the chemical industry's vulnerabilities to terrorist attacks.8 The
Chemical Safety Information, Site Security and Fuels Regulatory Relief Act
of 1999 required Justice to review and report on the vulnerability of
chemical facilities to terrorist or criminal attack. In May 2002, nearly 2
years after it was due, Justice prepared and submitted an interim report
to Congress that described observations on security at 11 chemical
manufacturing facilities Justice visited to develop a methodology for
assessing vulnerability, but its observations cannot be generalized to the
industry as a whole. In its fiscal year 2003 budget, Justice asked for $3
million to conduct chemical plant vulnerability assessments. In the
February 2003 conference report on Justice's appropriation act for fiscal
year 2003,9 Congress directed that $3 million of the funding being
transferred to DHS to be used for the chemical plant vulnerability
assessments. Justice believes that chemical plant vulnerability
assessments are now part of DHS' mission.
Federal agencies have taken preliminary steps to assist the industry in
its preparedness efforts. While Justice has not assessed the vulnerability
of the chemical industry, it has provided the industry with a tool for
individual facilities to use in assessing their vulnerabilities. Justice,
together with the Department of Energy's Sandia National Laboratories,
developed a vulnerability assessment methodology for evaluating the
vulnerability to terrorist attack of facilities handling chemicals. The
8For a discussion on Justice's actions to assess the chemical industry's
vulnerability to terrorist attack, see U.S. General Accounting Office,
Homeland Security: Department of Justice's Response to Its Congressional
Mandate to Assess and Report on Chemical Industry Vulnerabilities,
GAO-03-24R (Washington, D.C.: Oct. 10, 2002).
9H.R. Conf. Rept. No. 108-10, at 600 (2003).
methodology helps facilities identify and assess threats, risks, and
vulnerabilities and develop recommendations to reduce risk, where
appropriate. As the lead federal agency for the operational response to
terrorism, Justice's FBI is responsible for weapons of mass destruction
threat assessment and communicating warnings. Finally, agents in the FBI's
local field offices provide information and technical assistance to state
and local jurisdictions and to some chemical facilities to bolster their
preparedness to respond to terrorist incidents.
EPA has also taken some actions. Officials have analyzed the agency's
database of RMP facilities to identify high-risk sites for DHS and
Justice's Federal Bureau of Investigation (FBI). But these facilities are
only a portion of the universe of all industrial facilities that house
toxic or hazardous chemicals. At the time of our review, EPA had not
analyzed non-RMP facilities to determine whether any of those facilities
should be considered at high risk for a terrorist attack. EPA has also
issued warning alerts to the industry, hosted training classes on
vulnerability assessment methodologies, and informally visited about 30
high-risk facilities to learn about and encourage security efforts.
Finally, DHS' Information Analysis and Infrastructure Protection
directorate collects information from the U.S. intelligence community,
other federal agencies, and the private sector. Working with ACC, an
industry association representing chemical manufacturers, DHS also
supports the Chemical Sector Information Sharing and Analysis Center to
collect and share threat information for the chemical industry. In
addition, according to EPA officials, DHS has begun identifying high-risk
facilities and conducting site visits at facilities. However, neither EPA
nor DHS is currently monitoring the extent to which the industry has
implemented security measures.
The chemical manufacturing industry has undertaken a number of voluntary
initiatives to address security concerns at chemical facilities, including
developing security guidelines and tools to assess vulnerabilities, but
major challenges remain. All of the industry groups with whom we met have
taken actions such as forming security task forces, holding meetings and
conferences to share security information with members, and participating
in security briefings with federal agencies. In response to the terrorist
attacks on September 11, 2001, ACC-whose members own or operate
approximately 1,000 RMP facilities --now requires its members, as a
condition of membership, to rank facilities using a screening tool to
evaluate its facilities' risk level. It also requires facilities to
identify, assess, and address vulnerabilities at facilities using one of
several available
Chemical Industry Has Taken Voluntary Actions to Address Security Concerns but
Faces Significant Challenges in Preparing Against Terrorist Attacks
vulnerability assessment methodologies. In doing so, ACC member facilities
generally follow a multistep process that includes
o evaluating on-site chemical hazards, existing safety and security
features, and the attractiveness of the facility as a terrorist target;
o using hypothetical threat scenarios to identify how a facility is
vulnerable to attack; and
o identifying security measures that create layers of protection around
a facility's most vulnerable areas to detect, delay, or mitigate the
consequences of an attack.
ACC established time frames for completing the vulnerability assessment
and implementing security measures, based on the facility's risk ranking.
ACC reports that the 120 facilities ranked as the highest risk and 372
facilities ranked as the next highest have completed vulnerability
assessments. Most of ACC's lower-risk facilities are progressing on
schedule. ACC generally requires third-party verification that the
facility has made the improvements identified in its vulnerability
assessment.10
While these are commendable actions, they do not provide a high level of
assurance that chemical facilities have better protected their facilities
from terrorist attack. First, ACC does not require third parties to verify
that the facility has conducted the vulnerability assessment appropriately
or that its actions adequately address security risks. Even though
compliance with ACC's safety and security requirements is a condition of
membership, we do not believe that its requirements for facilities to
periodically report on compliance with these requirements is an effective
enforcement measurement because ACC does not verify implementation or
evaluate the adequacy of facility measures. Second, its member facilities
comprise only 7 percent of the facilities required to submit risk
management plans to EPA, leaving about 14,000 other RMP facilities that
may not participate in voluntary security efforts. These facilities
include agricultural suppliers, such as fertilizer facilities; petroleum
and natural gas facilities; food storage facilities; water treatment
facilities; and wastewater treatment facilities, among others. Third,
other facilities house
10The lowest-risk facilities may use a less rigorous methodology to
identify and make security enhancements and are not required to obtain
third-party verification that improvements have been made. In addition, by
December 2005, member companies will have to had their compliance with
safety and security requirements certified by independent third-party
auditors.
chemicals that EPA has identified as hazardous, but in quantities that are
below the threshold level required to be categorized as RMP facilities.
Other industry groups are also developing security initiatives, but the
extent of these efforts varies from issuing security guidance to requiring
vulnerability assessments. For example, the American Petroleum Institute,
which represents petroleum and natural gas facilities, published security
guidelines developed in collaboration with the Department of Energy that
are tailored to the differing security needs of industry sectors. Despite
industry associations' efforts to encourage security actions at
facilities, the extent of participation in voluntary initiatives is
unclear. EPA officials estimate that voluntary initiatives led by industry
associations only reach a portion of the 15,000 RMP facilities.
Furthermore, EPA officials stated that these voluntary initiatives raise
an issue of accountability, since the extent to which industry group
members are implementing voluntary initiatives is unknown.
The chemical industry faces a number of challenges in preparing facilities
against terrorist attacks, including ensuring that facilities obtain
adequate information on threats and determining the appropriate security
measures given the level of risk. Trade association and industry officials
identified a number of concerns about preparing against terrorist attacks.
First, industry officials noted that they need better threat information
from law enforcement agencies, as well as better coordination among
agencies providing threat information. Second, industry officials report
that chemical companies face a challenge in achieving cost-effective
security solutions, noting that companies must weigh the cost of
implementing countermeasures against the perceived reduction in risk.
Industry groups with whom we spoke indicated that their member companies
face the challenge of effectively allocating limited security resources.
Third, facilities face pressure from public interest groups to implement
inherently safer practices (referred to in the industry as inherently
safer technologies), such as lowering toxic chemical inventories and
redesigning sites to reduce risks. Justice has also recognized that
reducing the quantity of hazardous material may make facilities less
attractive to terrorist attack and reduce the severity of an attack. While
industry recognizes the contribution that inherently safer technologies
can make to reducing the risk of a terrorist attack, industry officials
noted that decisions about inherently safer technologies require thorough
analysis and may shift, rather than reduce, risks. Finally, industry
officials stated that the industry faces a challenge in engaging all
chemical facilities in voluntary security efforts. ACC has made efforts to
enlist facilities beyond its membership in voluntary security initiatives.
The Synthetic Organic
Chemical Manufacturers' Association (SOCMA) adopted ACC's security code
for its member facilities as a condition of membership. However, the
extent to which all partnering companies and associations implement the
requirements is unclear.
Mr. Chairman, this concludes my prepared statement. I would be happy to
respond to any questions that you or Members of the Subcommittee may have.
Contacts and For further information about this testimony, please contact
me at (202) 512-3841. Joanna Owusu, Vince Price, Carol Herrnstadt Shulman,
and AmyAcknowledgements Webbink made key contributions to this statement.
Appendix I: RMP-Covered Industrial Processes and Off-Site Consequences of
Worst-Case Chemical Releases
This appendix presents information on the processes covered under the
Clean Air Act's requirements for risk management plan (RMP) facilities by
industry sector and the residential population surrounding RMP facilities
that could be threatened by a "worst-case" accidental chemical release.
Table 1: Number and Percent of RMP-Covered Processes by Industry Sector
Number of Percent of
Industry sector processes processes
Agriculture & farming, farm supply, fertilizer 6,317
production, pesticides
Water supply and wastewater treatment 3,753
Chemical manufacturing 3,803
Energy production, transmission, transport, and 3,038 15
sale
Food and beverage manufacturing & storage 2,366 11
(including refrigerated warehousing)
Chemical warehousing (not including refrigerated 318 warehousing)
Othera 1,075
Totalb 20,670
Source: EPA.
aOther represents a large variety of industry sectors including pulp
mills, iron and steel mills, cement manufacturing, and computer
manufacturing.
bThe total number of covered processes is not equal to the 15,000 RMP
facilities because some RMP facilities have more than one covered process
(i.e., a process containing more than a threshold amount of a covered
hazardous chemical).
Figure 1: Number of Facilities with Worst-Case Accidental Release
Scenarios by Residential Population Potentially Threatened
Notes: EPA, Chemical Accident Risks in U.S. Industry - A Preliminary
Analysis of Accident Risk Data from U.S. Hazardous Chemical Facilities,
Washington, D.C.: September 25, 2000.
This figure includes only those facilities with toxic chemicals that could
lead to a "worst-case" scenario. Facilities that only have flammable
chemical "worst-case" scenarios are not included. Flammable chemicals
affect fewer people because the distance the flammable substance travels
tends to be significantly shorter.
This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed in
its entirety without further permission from GAO. However, because this
work may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this material
separately.
GAO's Mission
Obtaining Copies of GAO Reports and Testimony
The General Accounting Office, the audit, evaluation and investigative arm
of Congress, exists to support Congress in meeting its constitutional
responsibilities and to help improve the performance and accountability of
the federal government for the American people. GAO examines the use of
public funds; evaluates federal programs and policies; and provides
analyses, recommendations, and other assistance to help Congress make
informed oversight, policy, and funding decisions. GAO's commitment to
good government is reflected in its core values of accountability,
integrity, and reliability.
The fastest and easiest way to obtain copies of GAO documents at no cost
is through the Internet. GAO's Web site (www.gao.gov) contains abstracts
and fulltext files of current reports and testimony and an expanding
archive of older products. The Web site features a search engine to help
you locate documents using key words and phrases. You can print these
documents in their entirety, including charts and other graphics.
Each day, GAO issues a list of newly released reports, testimony, and
correspondence. GAO posts this list, known as "Today's Reports," on its
Web site daily. The list contains links to the full-text document files.
To have GAO e-mail this list to you every afternoon, go to www.gao.gov and
select "Subscribe to e-mail alerts" under the "Order GAO Products"
heading.
Order by Mail or Phone The first copy of each printed report is free.
Additional copies are $2 each. A check or money order should be made out
to the Superintendent of Documents. GAO also accepts VISA and Mastercard.
Orders for 100 or more copies mailed to a single address are discounted 25
percent. Orders should be sent to:
U.S. General Accounting Office 441 G Street NW, Room LM Washington, D.C.
20548
To order by Phone: Voice: (202) 512-6000 TDD: (202) 512-2537 Fax: (202)
512-6061
Contact:
To Report Fraud, Web site: www.gao.gov/fraudnet/fraudnet.htm
Waste, and Abuse in E-mail: [email protected]
Federal Programs Automated answering system: (800) 424-5454 or (202)
512-7470
Jeff Nelligan, Managing Director, [email protected] (202) 512-4800
Public Affairs U.S. General Accounting Office, 441 G Street NW, Room 7149
Washington, D.C. 20548
*** End of document. ***