Homeland Security: Federal and Industry Efforts Are Addressing	 
Security Issues at Chemical Facilities, but Additional Action Is 
Needed (27-APR-05, GAO-05-631T).				 
                                                                 
Terrorist attacks on chemical facilities could severely damage	 
the U.S. economy and public health. About 15,000 facilities	 
produce, use, or store large amounts of chemicals that pose the  
greatest risk to human health and the environment. While the	 
Environmental Protection Agency (EPA) formerly had the lead role 
in federal efforts to ensure chemical facility security, the	 
Department of Homeland Security (DHS) is now the lead federal	 
agency responsible for coordinating government and private	 
efforts to protect these facilities from terrorist attacks. This 
testimony is based on GAO's past work on chemical facility	 
security and focuses on (1) the attractiveness of chemical	 
facilities as terrorist targets, (2) their diversity and risks,  
(3) federal security requirements for these facilities, and (4)  
federal and industry efforts to improve facility security.	 
-------------------------Indexing Terms------------------------- 
REPORTNUM:   GAO-05-631T					        
    ACCNO:   A22803						        
  TITLE:     Homeland Security: Federal and Industry Efforts Are      
Addressing Security Issues at Chemical Facilities, but Additional
Action Is Needed						 
     DATE:   04/27/2005 
  SUBJECT:   Chemical agents					 
	     Counterterrorism					 
	     Facility security					 
	     Federal facilities 				 
	     Homeland security					 
	     Interagency relations				 
	     Strategic planning 				 
	     Terrorism						 
	     Toxic substances					 
	     Emergency preparedness				 
	     National preparedness				 

******************************************************************
** This file contains an ASCII representation of the text of a  **
** GAO Product.                                                 **
**                                                              **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced.  Tables are included, but    **
** may not resemble those in the printed version.               **
**                                                              **
** Please see the PDF (Portable Document Format) file, when     **
** available, for a complete electronic file of the printed     **
** document's contents.                                         **
**                                                              **
******************************************************************
GAO-05-631T

United States Government Accountability Office

GAO Testimony

Before the Committee on Homeland Security and Governmental Affairs, U.S.
Senate

For Release on Delivery

Expected at 10:00 a.m. EDT HOMELAND SECURITY

Wednesday, April 27, 2005

    Federal and Industry Efforts Are Addressing Security Issues at Chemical
                  Facilities, but Additional Action Is Needed

Statement of John B. Stephenson, Director Natural Resources and Environment

GAO-05-631T

[IMG]

April 27, 2005

HOMELAND SECURITY

Federal and Industry Efforts Are Addressing Security Issues at Chemical
Facilities, but Additional Action Is Needed

  What GAO Found

Experts agree that the nation's chemical facilities are attractive targets
for terrorists. The theft or release of certain chemicals could disrupt
the local economy, impact other critical infrastructures that rely on
chemicals, or impact the health and safety of millions of Americans. For
example, a 2002 Brookings Institution report ranks an attack on toxic
chemical plants behind only biological and atomic attacks in terms of
possible fatalities. While several efforts are underway, no one has yet
comprehensively assessed security at the nation's chemical facilities.

The chemical sector includes a variety of facilities and risks. The 15,000
facilities with large amounts of the most dangerous chemicals include
chemical manufacturers, water supply facilities, and fertilizer
facilities, among others. Some facilities may be at higher risk of a
terrorist attack than others because of the specific chemicals on site and
their proximity to population centers. According to 2003 EPA data, 123
U.S. chemical facilities had "worst-case" scenarios where more than one
million people could be at risk of exposure to a cloud of toxic gas. While
EPA and DHS believe that these scenarios overstate the potential
consequences of a chemical release, there are situations where an attack
could have potentially more severe consequences.

Only about one-sixth of the 15,000 facilities with large amounts of
dangerous chemicals are covered by federal security requirements. About
2,000 community water systems and 238 facilities that are located on
waterways and handle "bulk liquid chemicals" must conduct vulnerability
assessments, among other things, under the Public Health Security and
Bioterrorism Response Act of 2002 and the Maritime Transportation Security
Act of 2002, respectively. However, the federal government places
requirements on chemical facilities to address accidental releases, which
may also reduce the likelihood and mitigate the consequences of terrorist
attacks.

A number of federal and industry efforts are underway to enhance chemical
facility security. DHS is developing a strategy to protect the chemical
sector, identify high-risk facilities, and integrate chemical sector
protection efforts into a national program. With no authority to require
facilities to improve security, DHS has provided the industry with
financial assistance, information, and training, assessed facility
vulnerability, and recommended security improvements. About 1,100
facilities participate in a voluntary industry effort in which they assess
vulnerabilities, develop security plans, and undergo a third party
verification that the facilities implemented the identified physical
security enhancements. The extent to which the remaining facilities are
addressing security is unclear and the extent of chemical facilities'
security preparedness is unknown. In this context, a comprehensive
national strategy to identify high-risk facilities and require facilities
to assess their vulnerabilities, among other actions, would help to ensure
that security vulnerabilities at chemical facilities are addressed.

United States Government Accountability Office

Madame Chairman and Members of the Committee:

Thank you for this opportunity to discuss our work on chemical facility
security.1 As the events of September 11, 2001, showed, a terrorist attack
on infrastructure that is critical to our nation's economy can cause
enormous damage to our country and jeopardize public health and safety.
The USA PATRIOT Act defined critical infrastructure as those "systems and
assets...so vital to the United States that the incapacity or destruction
of such systems and assets would have a debilitating impact on security,
national economic security, national public health or safety, or any
combination of those matters."2 We often take these systems for granted
because they are so basic in our daily lives that we generally only notice
them when their service is interrupted. The President's February 2003
National Strategy for the Physical Protection of Critical Infrastructures
and Key Assets sets forth the federal government's goals, objectives, and
responsibilities in protecting the nation's critical infrastructure. The
strategy, as well as a presidential directive issued in December 2003,
identified the chemical industry among the sectors that are critical to
the nation's infrastructure.3 The chemical sector produces, uses, stores,
and distributes the chemicals needed to manufacture thousands of products,
such as those used in agriculture, pharmaceuticals, and automobiles.

The national strategy states that the private sector bears primary
responsibility for protecting their facilities from deliberate acts of
terrorism. While federal, state, and local governments work in partnership
with the private sector to protect chemical facilities, before September
11, 2001, attention was largely focused on the risks of accidental, rather
than intentional, chemical releases. In this regard, the Environmental
Protection Agency (EPA) regulates about 15,000 facilities under the Clean
Air Act because they produce, use, or store more than certain threshold
amounts of specific chemicals that would pose the greatest risk to human
health and the environment if accidentally released into the air. These

1GAO, Homeland Security: Voluntary Initiatives Are Under Way at Chemical
Facilities, but the Extent of Security Preparedness is Unknown, GAO-03-439
(Washington, D.C.: March 2003) and Protection of Chemical and Water
Infrastructure: Federal Requirements, Actions of Selected Facilities, and
Remaining Challenges, GAO-05-327 (Washington, D.C.: March 2005).

2Pub. L. No. 107-56, S: 1016(e) (2001) (codified at 42 U.S.C. S:
5195c(e)).

3Homeland Security Presidential Directive Number 7 (Washington, D.C.:
December 17, 2003).

facilities must take a number of steps, including preparing a risk
management plan (RMP), to prevent and prepare for an accidental release
and, therefore, are referred to as "RMP" facilities. While EPA initially
had the lead responsibility for protecting the chemical infrastructure
sector, the Department of Homeland Security (DHS) is now the lead federal
agency. DHS is responsible for coordinating the efforts of government and
private institutions to protect critical infrastructure, including the
chemical sector, from terrorist attacks.

My remarks today are based on our March 2003 and March 2005 reports, and
will focus on (1) experts' views on the attractiveness of chemical
facilities as terrorist targets, (2) the diversity of these facilities and
their risks, (3) federal requirements that address security at these
facilities, and (4) an overview of steps the federal government and
industry have taken to improve facility security. For this work, we
interviewed officials from EPA, DHS, and the Department of Justice;
reviewed pertinent federal legislation, EPA data, and available reports;
and interviewed industry representatives from the American Chemistry
Council, other industry associations, and a number of chemical companies.
We conducted our work according to generally accepted government auditing
standards. We are currently reviewing ongoing federal and industry efforts
to improve chemical facility security, including the need for further
regulation. We plan to issue a report on our findings later this year.

                                Summary �

In summary, we found the following:

o  Experts agree that the nation's chemical facilities present an
attractive target for terrorists intent on causing massive damage. For
example, the Department of Justice has concluded that the risk of an
attempt in the foreseeable future to cause an industrial chemical release
is both real and credible. Terrorist attacks involving the theft or
release of certain chemicals could significantly impact the health and
safety of millions of Americans, disrupt the local or regional economy, or
impact other critical infrastructures that rely on chemicals, such as
drinking water and wastewater treatment systems. Despite efforts by DHS to
assess facility vulnerabilities and suggest security improvements, no one
has comprehensively assessed security at facilities that house chemicals
nationwide.

o  DHS has not yet determined the number and type of facilities that
should be considered as part of the chemical infrastructure sector. The
universe of facilities with chemicals is diverse, and they present a
variety of risks.

About 15,000 RMP facilities produce, use, or store more than threshold
amounts of chemicals that EPA has estimated pose the greatest risk to
human health and the environment if they were accidentally released into
the air. RMP facilities include chemical manufacturers, water supply and
wastewater treatment facilities, agricultural suppliers such as fertilizer
facilities, food storage facilities, pulp and paper manufacturers, and
iron and steel mills, among others. Some facilities may be at higher risk
of a terrorist attack than others because of the chemicals they house and
their proximity to population centers. According to 2003 EPA data, the
toxic "worst-case" scenarios for 123 chemical facilities stated that more
than one million people could be at risk of exposure to a cloud of toxic
gas. About 600 facilities could each potentially threaten between 100,000
and a million people and about 2,300 facilities could each potentially
threaten anywhere from 10,000 to 100,000 people. According to EPA and DHS,
the method for calculating these scenarios overstates the potential
consequences of a chemical release. However, because the scenarios
estimate the effects of an accidental toxic chemical release involving the
greatest amount of the toxic chemical held in a single vessel or pipe, not
the entire quantity on site, an attack that breached multiple chemical
vessels simultaneously could result in a larger release with potentially
more severe consequences than those outlined in "worst-case" scenarios.

o  Currently, no federal requirements comprehensively address security at
all U.S. chemical facilities. Only about one-sixth of the 15,000 RMP
facilities must comply with federal security requirements related to
terrorism. Approximately 2,000 RMP facilities are community water systems
subject to the Public Health Security and Bioterrorism Response Act of
2002 and therefore must conduct vulnerability analyses of their
facilities, among other things. According to the Coast Guard, 238 chemical
facilities that are located on waterways and handle "bulk liquid
chemicals" must assess the vulnerabilities of certain facilities and
develop and implement security plans under the Maritime Transportation
Security Act of 2002 and its implementing regulations. The remaining
chemical facilities are not subject to such security requirements.
Although the federal government does not require all chemical facilities
to adopt security measures against acts of terrorism, it does impose
safety and emergency response requirements on chemical facilities to
address accidental releases. These requirements may incidentally reduce
the likelihood and mitigate the consequences of terrorist attacks.

o  The federal government and the chemical industry have taken a number of
steps to enhance security at chemical facilities but further action is
needed. DHS' Information Analysis and Infrastructure Protection
Directorate is developing a strategy for protecting the chemical sector,

identifying high-risk facilities, and integrating chemical sector
protection efforts into a national program. Without specific authority to
require chemical facilities to improve security, DHS has worked with the
chemical industry by providing financial assistance, sharing information
about critical infrastructure protection, assessing facility
vulnerabilities, recommending security improvements, and providing
training. In addition, the chemical industry, led by its industry
associations, is conducting voluntary initiatives at member facilities.
The primary industry security initiative, the American Chemistry Council's
Responsible Care Management System(R), directs participating facilities to
assess vulnerabilities, develop security plans, and undergo a third party
verification that the facilities implemented the identified physical
security enhancements. These third parties are not required, however, to
verify that the vulnerability assessment is appropriately conducted and
that the actions taken by the facility adequately address security risks.
Nevertheless, ACC's self-initiated requirements incorporate elements of a
risk management framework and were designed to strengthen security at its
members' facilities. Approximately 1,100 (or 7 percent) of the 15,000 RMP
facilities are members of ACC and the Synthetic Organic Chemical
Manufacturers Association-which represents manufacturers who produce
specialty-chemicals at small-to medium-sized facilities-and, thus, are to
comply with the Responsible Care(R) security requirements. However, the
extent to which the remaining 14,000 RMP facilities, or other chemical
facilities that are not RMP facilities, may be voluntarily addressing
their security is unclear. Consequently, despite government and industry
efforts, the extent of security preparedness at chemical facilities is
unknown.

To ensure that chemical facilities take action to review and address
security vulnerabilities, we recommended in March 2003, that the Secretary
of Homeland Security and the Administrator of EPA jointly develop a
comprehensive national strategy for chemical security that is both
practical and cost effective. The strategy should, among other things,
identify high-risk facilities and collect information on industry security
preparedness. We also recommended that DHS and EPA develop a legislative
proposal, in consultation with industry and other appropriate groups, to
require these chemical facilities to expeditiously assess their
vulnerability to terrorist attacks and, where necessary, require these
facilities to take corrective action. At that time, DHS and EPA generally
agreed with these recommendations.

While EPA no longer has a key role in ensuring chemical facility security,
DHS has taken steps to implement our recommendations. In February 2005,
DHS released its Interim National Infrastructure Protection Plan.

While we have not fully evaluated this plan, it outlines a risk management
framework to guide future efforts to identify and protect critical
infrastructure and defines the roles of federal, state, local, and tribal
agencies and the private sector using elements of this framework. In
addition, DHS is developing a strategic plan specifically for securing the
chemical sector and has a number of efforts underway to help identify and
mitigate chemical facilities' vulnerabilities. We are evaluating DHS'
efforts and plans for improving chemical sector security in our ongoing
review.

In comments responding to our March 2003 report, DHS stated that voluntary
efforts alone will not be sufficient to assure an appropriate level of
security across the industry, and that, in the department's view, every
one of the approximately 15,000 RMP facilities nationwide should be
required to perform comprehensive vulnerability assessments and take
actions to reduce vulnerabilities. As part of our ongoing review for this
Committee, we plan to obtain DHS' current views on whether legislation is
still necessary and, if so, the types of provisions the agency feels would
best assist the nation's chemical facilities in addressing their
vulnerability to attack.

The Homeland Security Act of 2002 established DHS and set forth its
mission to, among other things, prevent terrorist attacks within the
United States, reduce the vulnerability of the United States to terrorism,
and minimize the damage and assist in the recovery from terrorist attacks
that do occur within the United States. Following passage of the act, a
December 2003 presidential directive states that DHS is responsible for
coordinating the overall national effort to enhance the protection of the
critical infrastructure and key resources of the United States. The
Secretary of Homeland Security serves as the principal federal official to
lead, integrate, and coordinate the implementation of efforts among
federal departments and agencies, state and local governments, and the
private sector to protect critical infrastructure and key resources. The
directive identified the chemical sector as a critical infrastructure
sector along with other sectors, including agriculture, banking and
finance, defense industrial base, emergency services, energy, food,
government, information and telecommunications, postal and shipping,
public health, transportation, and water. Under this presidential
directive, DHS is now the lead agency for the chemical infrastructure
sector, a change from national strategies issued in July 2002 and February
2003, which named EPA as the lead federal agency.

  Background

The presidential directive emphasized those critical infrastructure and
key resources that could be exploited to cause catastrophic health effects
or mass casualties. Because many chemicals are inherently hazardous, the
release of chemicals or the risk of contamination at chemical facilities
poses a potential threat to public health and the economy. Under the Clean
Air Act's Risk Management Program provisions, EPA identified 140 toxic and
flammable chemicals that, when present above certain threshold amounts,
would pose the greatest risk to human health and the environment if
released accidentally into the air. According to EPA, approximately 15,000
facilities in a variety of industries produce, use, or store one or more
of these chemicals beyond threshold amounts in one or more processes
(e.g., single or interconnected vessels or tanks).

Before these functions were transferred to DHS by the Homeland Security
Act of 2002, Justice was responsible for collecting information from the
U.S. intelligence community, the FBI's criminal investigations, other
federal agencies, and the private sector about threats, including those
involving chemicals. The Chemical Safety Information, Site Security and
Fuels Regulatory Relief Act required Justice to review the vulnerability
of chemical facilities to terrorist or criminal attack and report this
information to the Congress.4 Justice prepared and submitted an interim
report to Congress in May 2002 based on observations made at 11 chemical
manufacturing facilities.

  Experts Agree that Chemical Facilities Are an Attractive Target for Terrorists

Experts agree that the nation's chemical facilities present an attractive
target for terrorists intent on causing massive damage. Many facilities
house toxic chemicals that could become airborne and drift to surrounding
communities if released or could be stolen and used to create a weapon
capable of causing harm. Justice has been warning of the terrorist threat
to chemical facilities for a number of years and has concluded that the
risk of an attempt in the foreseeable future to cause an industrial
chemical release is both real and credible. Based on analysis of trends in
international and domestic terrorism and the burgeoning interest in
weapons of mass destruction among criminals and terrorists, Justice warned
of potential targeting by terrorists of chemical facilities before the
events of September 11, 2001. In fact, according to Justice, domestic
terrorists plotted to use a destructive device against a U.S. facility
that housed millions of gallons of propane in the late 1990s. In testimony
on

4Pub. L. No. 106-40, 113 Stat. 207 (1999).

February 6, 2002, the Director of the Central Intelligence Agency also
warned of the potential for an attack by al Qaeda on chemical facilities.

Terrorist attacks involving the theft or release of certain chemicals
could have a significant impact on the health and safety of millions of
Americans. The disaster at Bhopal, India in 1984, when methyl isocyanate
gas-a highly toxic chemical-leaked from a tank, reportedly killing about
3,800 people and injuring anywhere from 150,000 to 600,000 others,
illustrates the potential threat to public health from a chemical release.
While U.S. chemical facilities are subject to a number of safety
requirements, the Army has estimated high potential damage to the U.S.
population from an intentional toxic chemical release. During a 2001
informal meeting with a number of agencies, the Army Office of the Surgeon
General proposed, based on generic estimates, that it was conceivable that
as many as 2.4 million people could request medical treatment if a
terrorist caused the release of a toxic chemical.5 According to officials
from that office, these estimates include anyone who seeks medical
attention as a result of the release-including people with minor
irritations or concerns. Similarly, a 2002 Brookings Institution report
ranks an attack on toxic chemical plants behind only biological and atomic
attacks in terms of possible fatalities.6 In January 2005 testimony before
the Senate Committee on Homeland Security and Governmental Affairs on
challenges facing DHS, a Brookings Institution Visiting Fellow identified
chemical facility security as a priority for DHS, noting that toxic
industrial chemicals present the potential for mass casualties from a
terrorist attack that is rivaled only by improvised nuclear devices,
certain acts of bioterrorism, and the collapse of large, occupied
buildings.7

In addition to the potential loss of life, a terrorist attack on a
chemical facility could also disrupt the local or regional economy or
impact other critical infrastructures. The chemical manufacturing industry
produces the chemicals used in agriculture, pharmaceuticals, drinking
water and

5U.S. Army, Draft Medical NBC Hazard Analysis of
Chemical-Biological-Radiological-Nuclear-High Explosive Threat, Possible
Scenarios & Planning Requirements, Army Office of the Surgeon General
(October 2001).

6The Brookings Institution, Protecting the American Homeland: A
Preliminary Analysis, (Washington, D.C.: 2002).

7Statement of Richard A. Falkenrath, Visiting Fellow, The Brookings
Institution, before the United States Senate Committee on Homeland
Security and Governmental Affairs (January 26, 2005).

wastewater treatment systems, and food processing. DHS' February 2005
Interim National Infrastructure Protection Plan notes that many critical
infrastructure assets are dependent on multiple elements and systems to
remain functional. In some cases, a failure in one sector will have a
significant impact on the ability of another sector to perform necessary
functions. For example, rail transportation of many hazardous materials
including chlorine was disrupted in some states following the events of
September 11, 2001, because of concern about the potential for an
intentional chemical release. This disruption to rail service impacted
drinking water facilities that relied on chlorine delivered by rail to
purify water.

Currently, no one has comprehensively assessed security across the nation
at facilities that house chemicals. Both EPA and DHS officials have
visited some chemical facilities to discuss security since September 11,
2001, but the results of these visits are not publicly available. EPA
visited 30 highrisk chemical facilities to discuss security, and DHS has
visited a number of chemical facilities to assist owner/operators in
assessing vulnerabilities at their facilities. During a limited review of
chemical industry vulnerabilities conducted at 11 facilities primarily
before September 11, 2001, Justice found that some chemical facilities may
need to implement more effective security systems and develop alternative
means to reduce the potential consequences of a successful attack. The
effectiveness of security at some facilities may also be in doubt as
evidenced by several media accounts of reporters and environmental
activists gaining access to chemical tanks and computer centers that
control manufacturing processes at facilities in 2001, 2002, and 2003.

DHS has not yet determined the number and type of facilities that should
be considered as part of the chemical infrastructure sector. The universe
of chemical facilities is diverse in that they produce, use or store a
host of products, including (1) basic chemicals used to manufacture other
products such as fertilizers, plastics, and synthetic fibers; (2)
specialty chemicals used for a specific purpose such as a functional
ingredient or a processing aid in the manufacture of a range of products
such as adhesives and solvents, coatings, industrial gases and cleaners,
and water management chemicals; (3) life science chemicals consisting of
pharmaceuticals and pesticides; and (4) consumer products such as hair and
skin products and cosmetics. In total, about 15,000 RMP facilities
produce, use, or store more than threshold amounts of one or more of the
140 toxic and flammable chemicals that EPA has estimated pose the greatest
risk to human health and the environment if accidentally released

  Chemical Infrastructure Sector Includes Many Types of Facilities with
  Different Risks

into the air. Approximately 4,000 facilities manufacture these chemicals,
and numerous other types of facilities-agricultural suppliers such as
fertilizer facilities, food storage facilities, pulp and paper
manufacturers, iron and steel mills, and computer manufacturing
facilities-also house large quantities of chemicals. While the universe of
chemical facilities is diverse, some of these facilities are part of other
critical infrastructure sectors. For example, about 2,000 of these
facilities are community water systems that are part of the water
infrastructure sector.

Some facilities may be at higher risk of a terrorist attack than others
because of the chemicals they house and their proximity to population
centers. Toxic chemicals such as chlorine and ammonia could form a toxic
cloud and drift over neighboring populations if released, while flammable
chemicals such as butane and hydrogen could be used in destructive
devices. Assuming that the objective of an attack is a catastrophic
release of a toxic chemical, attacks on such facilities could harm a large
number of people with health effects ranging from mild irritation to
death. No specific data are available on what the actual effects of
successful terrorist attacks on chemical facilities would be. However, RMP
facilities submit to EPA estimates of the potential consequences to
surrounding communities of hypothetical "worst-case" accidental chemical
releases from their facilities. These estimates include the residential
population located within the range of a toxic gas cloud produced by a
"worst-case" chemical release, called the "vulnerable zone." According to
2003 EPA data, 123 chemical facilities located throughout the nation had
toxic "worst-case" scenarios where more than one million people would be
in the "vulnerable zone" and could be at risk of exposure to a cloud of
toxic gas.8 About 600 facilities could each potentially threaten between
100,000 and a million people, and about 2,300 facilities could each
potentially threaten between 10,000 and 100,000 people within these
facilities' "vulnerable zones."

8"Vulnerable zones" are determined by drawing a circle around a facility
with the radius of the circle equal to the distance a toxic gas cloud
would travel before dissipating to relatively harmless levels. Because, in
an actual event, the toxic cloud would only cover a fraction of that
circle, it is unlikely that the event would actually result in exposure of
the entire population estimated in the "worst-case" scenario, according to
EPA. The number of persons within a "vulnerable zone" is larger than the
number of persons that would be affected by a "worst-case" scenario. In
addition, EPA's requirements for "worst-case" release analysis tend to
result in consequence estimates that are significantly higher than what is
likely to actually occur. For example, "worst-case" release analysis does
not take into account active mitigation measures facilities often employ
to reduce the consequences of releases.

According to EPA and DHS, the method for calculating "worst-case" scenario
calculations for RMP facilities overstates the potential consequences of a
chemical release. The scenarios do not consider the potential causes of a
release or how different causes or other circumstances, such as safety
features, could lessen the consequences of a release. Furthermore, the
scenarios' "vulnerable zones" include the population in the entire area
surrounding the facility, while the wind would typically carry the toxic
cloud in one direction affecting only a portion of the area. While
officials believe these scenarios are overstated, there are situations
where an attack could result in larger consequences. EPA regulations
require RMP facilities to estimate the effects of a toxic chemical release
involving the greatest amount of the toxic chemical held in a single
vessel or pipe, rather than the entire quantity on site. Therefore, for
some facilities, an attack could breach multiple chemical vessels
simultaneously and could result in a larger release with potentially more
severe consequences than estimated in the "worst-case" scenario.

  Few Federal Requirements Address Security at the Nation's Chemical Facilities

Currently, few federal requirements address security at U.S. chemical
facilities. While some chemical facilities must comply with the Public
Health Security and Bioterrorism Response Act of 2002 (Bioterrorism Act)
and the Maritime Transportation Security Act of 2002 (MTSA), many are not
subject to any federal security requirements. The Bioterrorism Act
requires community water systems serving more than 3,300 people to perform
vulnerability analyses of their facilities, among other things. Many of
these facilities may store hazardous chemicals for water treatment and are
not required to implement any risk reduction actions based on their
vulnerability assessments or report to EPA on measures that have been
implemented. EPA estimated in 2003, that approximately 2,000 RMP
facilities may be community water systems covered under the Bioterrorism
Act. MTSA and its implementing regulations require maritime facility
owners and operators to conduct assessments of certain at-risk facilities
to identify vulnerabilities, develop security plans to mitigate these
vulnerabilities, and implement the measures discussed in the security
plans. According to the Coast Guard, 238 chemical facilities are located
on waterways and handle "bulk liquid chemicals" are subject to MTSA
requirements.

The remaining chemical facilities, including the approximately 13,000 RMP
facilities, are subject to no federal requirements specifically related to
improving security against terrorist attacks. Although these facilities
pose different levels of risk depending on the chemicals they use or
store, thousands house quantities of toxic chemicals that could impact

neighboring populations if released. The security requirements for the
chemical sector stand in contrast to a number of other critical
infrastructure sectors that are subject to federal security requirements.
In addition to community water systems, all commercial nuclear power
plants licensed by the Nuclear Regulatory Commission are subject to a
number of security requirements, including placing physical barriers
outside the operating reactor area, limiting access to vital areas,
maintaining a trained security force, and conducting simulated terrorist
attack exercises.

While the federal government does not require all chemical facilities to
take security measures to protect against a terrorist attack, it does
impose safety and emergency response requirements on chemical facilities,
which may incidentally reduce the likelihood and mitigate the consequences
of terrorist attacks. For example, the Emergency Planning and Community
Right to Know Act requires owners and operators of facilities that
maintain specified quantities of certain extremely hazardous chemicals to
annually submit information on their chemical inventory to state and local
emergency response officials. This information is used to help prepare
community response plans in the event of a chemical incident. Under
Section 112(r) of the Clean Air Act, EPA's Risk Management Program
requires owners and operators of facilities that handle listed extremely
hazardous substances over a threshold amount to prepare and implement a
risk management plan to detect and prevent or minimize accidental
releases. In addition to evaluating "worst-case" accidental release
scenarios, facility owners and operators must implement a program to
prevent accidental releases that includes safety precautions and
maintenance, monitoring, training measures, and must have an emergency
response plan. The Department of Labor's Occupational Safety and Health
Administration's process safety management standard also requires
facilities to assess and address the hazards of their chemical process.
These requirements could potentially mitigate a terrorist attack by (1)
providing an incentive to facilities to reduce or eliminate chemicals
below regulated threshold levels, (2) requiring facilities to implement
measures to improve the safety of areas that are vulnerable to a chemical
release, and (3) facilitating emergency response planning that increases
preparedness for a chemical release-whether intentional or unintentional.

  Federal Government and Industry Have Taken Steps to Improve Facility Security,
  but Further Action Is Needed

The federal government and the chemical industry have taken a number of
steps to enhance security at chemical facilities. DHS' Information
Analysis and Infrastructure Protection Directorate has a number of
initiatives underway to develop a strategy for protecting the chemical
sector, identify high-risk facilities, and integrate chemical sector
protection efforts into a national program. In February 2005, DHS released
an Interim National Infrastructure Protection Plan. While we have not yet
fully evaluated this plan, it outlines a risk management framework to
guide future efforts to identify and protect critical infrastructure and
defines the roles of federal, state, local, and tribal agencies and the
private sector. DHS is also developing a vulnerability and risk assessment
methodology designed to assist facilities with analyzing security, help
DHS rank these facilities by risk, and allow DHS to compare assets across
sectors.9

Without specific authority to require that chemical facilities make
security improvements, DHS has worked voluntarily with the chemical
industry to provide financial assistance, share information about critical
infrastructure protection, provide training and exercises, and assess
facility vulnerabilities and recommend security improvements. DHS has
provided training programs to first responders and facility security
officers and held drills at chemical facilities. DHS has also provided
advice and guidance to state and local partners to reduce vulnerabilities
in buffer zones (the area extending from the facility to the surrounding
community) and conducted site assistance visits.

The chemical sector, led by its industry associations, also has voluntary
initiatives underway at member facilities. Industry associations have
issued security guidance, identified security best practices, and
developed vulnerability assessment methodologies specific to their
members. In addition, industry is assisting DHS in developing a
methodology for assessing risk in the chemical sector. To provide a
mechanism for coordinating with DHS, in June 2004, the chemical industry
established the Chemical Sector Council to identify, prioritize, and
coordinate the protection of the industry's critical infrastructure and
key resources, and to facilitate the sharing of information about physical
and cyber threats, vulnerabilities, incidents, potential protective
measures, and best

9DHS is developing this methodology-called the Risk Analysis and
Management for Critical Asset Protection (RAMCAP)-in conjunction with the
American Society of Mechanical Engineers.

practices. The Council is composed of 16 sector associations representing
a range of chemical facilities.10

The primary security initiative undertaken by the industry directs
participating chemical facilities to assess vulnerabilities and develop
security plans to address them. In this regard, the American Chemistry
Council (ACC)-whose members own or operate approximately 1,000 (or about 7
percent) of the 15,000 RMP facilities-requires its members to perform
vulnerability assessments, develop plans to mitigate vulnerabilities, and
take actions to implement the plans.11 Companies are then required to have
third parties such as local emergency responders or local law enforcement
officials verify that physical security enhancements identified in
facility plans were implemented. These third parties are not required,
however, to verify that the vulnerability assessment is appropriately
conducted and that the actions taken by the facility adequately address
security risks.

ACC also has a new requirement that independent auditors certify that
member companies have management systems in place. These audits will
confirm that companies have security programs and processes. According to
ACC, all of its members have conducted vulnerability assessments, and most
have completed security enhancements and had them verified. The Synthetic
Organic Chemical Manufacturers Association (SOCMA), which represents
manufacturers who produce specialty chemicals at small-to medium-sized
facilities, also adopted these security requirements for all of their
member facilities, which include 77 of the 15,000 RMP facilities.12

10As of April 2005, Chemical Sector Council members included the American
Chemistry Council, the American Forest and Paper Association, the Chemical
Producers and Distributors Association, the Chlorine Chemistry Council,
the Compressed Gas Association, CropLife America, the Institute of Makers
of Explosives, the International Institute of Ammonia Refrigeration, the
National Association of Chemical Distributors, the National Paint and
Coatings Association, the National Petrochemical and Refiners Association,
the Synthetic Organic Chemical Manufacturers Association, the Adhesive and
Sealant Council, the Chlorine Institute, the Fertilizer Institute, and the
Society of the Plastics Industry, Inc.

11ACC adopted a security code to accompany its Responsible Care Management
System(R), a voluntary program to achieve improvements in environmental,
health, and safety performance through management practices addressing a
range of business activities. Member companies must comply with
Responsible Care(R) requirements as a condition of membership.

12SOCMA has 160 member companies. Thirty-six of these companies are also
members of ACC and follow the Responsible Care(R) requirements.. The
remaining 124 SOCMA member companies operate 273 facilities-of which 77
are RMP facilities.

ACC and SOCMA's self-initiated membership requirements incorporate
elements of a risk management framework, which can aid in assessing risk
by determining which vulnerabilities should be addressed in what ways
within available resources, and were designed to strengthen security at
facilities that comply with its requirements. The actions required by
Responsible Care(R) may exceed efforts taken by non-participating
facilities.

Despite these efforts, the overall extent of security preparedness at
chemical facilities is unknown. While DHS has a number of programs
underway to identify high-risk facilities and assess their
vulnerabilities, these programs are in their infancy. As a result, neither
DHS nor any other federal entity has yet assessed the overall extent of
security preparedness at the nation's chemical facilities. While chemical
industry associations have worked closely with member companies to
evaluate and improve security at facilities, the extent of participation
in voluntary initiatives is unclear. EPA officials estimated in 2003, that
voluntary initiatives led by industry associations only reach a portion of
the 15,000 RMP facilities. Further, EPA and DHS have stated publicly that
voluntary efforts alone are not sufficient to assure the public of the
industry's preparedness. In this context, a comprehensive national
chemical security strategy that would, among other actions, identify
high-risk facilities and require facilities to assess their
vulnerabilities and take any needed corrective actions would help to
ensure that security vulnerabilities at chemical facilities are addressed.

Across the nation, thousands of industrial facilities manufacture, use, or
store hazardous chemicals in quantities that could potentially put large
numbers of Americans at risk of injury or death in the event of a chemical
release. Experts agree that chemical facilities are an attractive target
to terrorists because of the potential to harm large numbers of people and
disrupt the economy or other critical infrastructures. Yet, despite
efforts since September 11, 2001, to protect the nation from terrorism,
the extent of security preparedness at U.S. chemical facilities is
unknown. While some other critical infrastructures are required to assess
their vulnerabilities, no federal requirements are in place to require all
chemical facilities to assess their vulnerabilities and take steps to
reduce them. Both the federal government and the chemical industry have
taken steps to improve security at chemical facilities. However, these
efforts have not involved all facilities with significant quantities of
hazardous chemicals on site. Further action is needed to ensure that the
nation's chemical facilities-which produce, use, and store chemicals vital
to the

  Conclusions

manufacture of a range of everyday products-are assessing security
vulnerabilities and taking actions to address them.

Madame Chairman, this concludes our prepared statement. We would be happy
to respond to any questions that you or Members of the Committee may have.

Contacts and For further information about this testimony, please contact
me at (202) 512-3841. Jill Edelson, Joanna Owusu, Debra B. Sebastian, Amy
Webbink,Acknowledgments Leigh White, and Vincent P. Price made key
contributions to this statement.

This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed in
its entirety without further permission from GAO. However, because this
work may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this material
separately.

  GAO's Mission

Obtaining Copies of GAO Reports and Testimony

The Government Accountability Office, the audit, evaluation and
investigative arm of Congress, exists to support Congress in meeting its
constitutional responsibilities and to help improve the performance and
accountability of the federal government for the American people. GAO
examines the use of public funds; evaluates federal programs and policies;
and provides analyses, recommendations, and other assistance to help
Congress make informed oversight, policy, and funding decisions. GAO's
commitment to good government is reflected in its core values of
accountability, integrity, and reliability.

The fastest and easiest way to obtain copies of GAO documents at no cost
is through GAO's Web site (www.gao.gov). Each weekday, GAO posts newly
released reports, testimony, and correspondence on its Web site. To have
GAO e-mail you a list of newly posted products every afternoon, go to
www.gao.gov and select "Subscribe to Updates."

                        Order by Mail or Phone �

The first copy of each printed report is free. Additional copies are $2
each. A check or money order should be made out to the Superintendent of
Documents. GAO also accepts VISA and Mastercard. Orders for 100 or more
copies mailed to a single address are discounted 25 percent. Orders should
be sent to:

U.S. Government Accountability Office 441 G Street NW, Room LM Washington,
D.C. 20548

To order by Phone: Voice: (202) 512-6000 TDD: (202) 512-2537 Fax: (202)
512-6061

  To Report Fraud, Contact:

Waste, and Abuse in Web site: www.gao.gov/fraudnet/fraudnet.htm

E-mail: [email protected] Programs Automated answering system: (800)
424-5454 or (202) 512-7470

Gloria Jarmon, Managing Director, [email protected] (202)
512-4400Congressional U.S. Government Accountability Office, 441 G Street
NW, Room 7125 Relations Washington, D.C. 20548

Public Affairs Paul Anderson, Managing Director, [email protected] (202)
512-4800 U.S. Government Accountability Office, 441 G Street NW, Room 7149
Washington, D.C. 20548

                           PRINTED ON RECYCLED PAPER
*** End of document. ***