This is the accessible text file for GAO report number GAO-03-847 
entitled 'Combating Bioterrorism: Actions Needed to Improve Security at 
Plum Island Animal Disease Center' which was released on October 20, 
2003.

This text file was formatted by the U.S. General Accounting Office 
(GAO) to be accessible to users with visual impairments, as part of a 
longer term project to improve GAO products' accessibility. Every 
attempt has been made to maintain the structural and data integrity of 
the original printed product. Accessibility features, such as text 
descriptions of tables, consecutively numbered footnotes placed at the 
end of the file, and the text of agency comment letters, are provided 
but may not exactly duplicate the presentation or format of the printed 
version. The portable document format (PDF) file is an exact electronic 
replica of the printed version. We welcome your feedback. Please E-mail 
your comments regarding the contents or accessibility features of this 
document to Webmaster@gao.gov.

This is a work of the U.S. government and is not subject to copyright 
protection in the United States. It may be reproduced and distributed 
in its entirety without further permission from GAO. Because this work 
may contain copyrighted images or other material, permission from the 
copyright holder may be necessary if you wish to reproduce this 
material separately.

Ranking Democratic Member, Committee on Agriculture, Nutrition and 
Forestry, U.S. Senate:

September 2003:

Combating Bioterrorism:

Actions Needed to Improve Security at Plum Island Animal Disease 
Center:

GAO-03-847:

GAO Highlights:

Highlights of GAO-03-847, a report to the Ranking Democratic Member, 
Committee on Agriculture, Nutrition and Forestry, U.S. Senate 

Why GAO Did This Study:

Scientists at the Plum Island Animal Disease Center are responsible 
for protecting the nation against animal diseases that could be 
accidentally or deliberately introduced into the country. Questions 
about the security of Plum Island arose after the 2001 terrorist 
attacks and when employees of the contractor hired to operate and 
maintain the Plum Island facilities went on strike in August 2002. GAO 
reviewed (1) the adequacy of security at Plum Island and (2) how well 
the contractor performed during the strike. The Department of Homeland 
Security (DHS) assumed the administration of Plum Island from the 
Department of Agriculture (USDA) on June 1, 2003. While DHS is now 
responsible for Plum Island, USDA is continuing its research and 
diagnostic programs. 

What GAO Found:

Security at the Plum Island Animal Disease Center has improved, but 
fundamental concerns leave the facility vulnerable to security 
breaches. First, Plum Islands physical security arrangements are 
incomplete and limited. Second, Plum Island officials have been 
assuming unnecessary risks by not adequately controlling access to 
areas where pathogens are located. Controlling access is particularly 
important because pathogens are inherently difficult to secure at any 
facility. Although this risk may always exist, DHS could consult with 
other laboratories working with pathogens to learn different 
approaches to mitigate this risk. Third, Plum Islands security 
response has limitations. For example, the guard force has been armed 
but has not had the authority from USDA to carry firearms or make 
arrests. Moreover, Plum Islands incident response plan does not 
consider the possibility of a terrorist attack. Fourth, the risk that 
an adversary may try to steal pathogens is, in our opinion, higher at 
the Plum Island Animal Disease Center than USDA originally determined 
because of hostilities surrounding the strike. Also, when USDA 
developed its security plan for Plum Island, it did not review their 
defined threats with the intelligence community and local law 
enforcement officials to learn of possible threatsand their 
associated risksrelevant to the Plum Island vicinity. Although these 
reviews did not occur, USDA subsequently arranged to receive current 
intelligence information. 

Despite a decline in performance from the previous rating period, USDA 
rated the contractors performance as superior for the rating period 
during which the strike occurred. 

What GAO Recommends:

GAO recommends that DHS consult with USDA to correct physical security 
deficiencies; further limit access to pathogens; consult with other 
laboratories to identify ways to mitigate the inherent difficulty of 
securing pathogens; enhance response capabilities; reconsider risks 
and threats; and revise security and incident response plans as 
needed.

DHS agreed with the report and has started to implement our 
recommendations. USDA stated that the report was very useful.

www.gao.gov/cgi-bin/getrpt?GAO-03-847

To view the full product, including the scope and methodology, click 
on the link above. For more information, contact Larry Dyckman at 
(202) 512-3841 or dyckmanl@gao.gov.


[End of section]


Contents:

Letter: 

Results in Brief: 

Background: 

USDA Has Taken Strides To Improve Security at Plum Island, but 
Fundamental Concerns Remain: 

USDA Concluded Its Contractor's Performance Declined during the Strike 
but Operations Continued and Overall Performance Was Superior: 

Conclusions: 

Recommendations for Executive Action: 

Agency Comments: 

Appendixes:

Appendix I: Scope and Methodology: 

Appendix II: Additional Observations on Plum Island's Security System 
by GAO's Office of Special Investigations: 

Appendix III: LB&B Associates' Performance, Employee Qualifications, 
and Costs: 

Performance: 

Employee Qualifications: 

Costs Attributable to the Strike: 

Appendix IV: Comments from the Department of Homeland Security: 

Appendix V: Comments from the U.S. Department of Agriculture: 

Appendix VI: GAO Contact and Staff Acknowledgments: 

GAO Contact: 

Acknowledgments: 

Table: 

Table 1: Summary of the Award Fee Determination Board's Rating of LB&B 
Associates' Performance from April 2002 to January 2003.: 

Figures:

Figure 1: Plum Island, New York: 

Figure 2: USDA Award Fee Determination Board's Composite Scores for LB&B 
Associates' Performance from October 1999 through January 2003: 

Figure 3: Monthly Costs Billed to USDA, October 2001 through May 2003: 

Abbreviations: 

APHIS: Animal Plant and Health Inspection Service:

ARS: Agriculyural Research Service:

DHS: Department of Homeland Security:

FBI: Federal Bureau of Investigations:

GAO: General Accounting Office:

USDA: U.S. Department of Agriculture:

Letter September 19, 2003:

The Honorable Tom Harkin 
Ranking Democratic Member 
Committee on Agriculture, Nutrition and Forestry 
United States Senate:

Dear Senator Harkin:

The Plum Island Animal Disease Center--located in Long Island Sound off 
the coast of New York--researches contagious animal diseases that have 
been identified in other countries. The mission of the facility is to 
develop strategies for protecting the nation's animal industries and 
exports from these foreign animal diseases, which could be accidentally 
or deliberately introduced into the United States. Scientists at Plum 
Island--often with the assistance of scientists from other countries--
identify the pathogens and toxins (hereafter called pathogens) that 
cause these foreign animal diseases and then work to develop vaccines 
against them. Some of the pathogens maintained at the Plum Island 
Animal Disease Center, such as foot-and-mouth disease, are highly 
contagious to livestock and could cause catastrophic economic losses in 
the agricultural sector if they were released outside the facility. A 
few can also cause illness and death in humans. For this reason, 
research on these pathogens is conducted within a sealed biocontainment 
area that has special safety features designed to contain the 
pathogens.

Until recently, the Department of Agriculture (USDA) administered Plum 
Island, but in June 2003, it became the responsibility of the 
Department of Homeland Security (DHS).[Footnote 1] DHS officials told 
us that during a transition period that will last until September 31, 
2003, they will review USDA's policies and procedures for Plum Island 
and determine how best to administer the facility. USDA will continue 
to have access to the facility to perform its research and diagnostic 
programs.

Concerns about security at the Plum Island Animal Disease Center were 
heightened after the terrorist attacks of September 11, 2001, because 
of fears that someone might try to steal certain pathogens from the 
facility to conduct bioterrorist activities. As a result, USDA 
contracted with Sandia National Laboratories--experts involved in a 
range of national security areas, including ensuring the safety of 
nuclear weapons--to evaluate the effectiveness of, and make 
recommendations to improve, Plum Island's security program. USDA worked 
with Sandia to develop a risk management approach to improve security 
on the island. Some other agencies employ this method for their 
security planning, including the Department of Energy; we have also 
endorsed a risk management approach for addressing security 
risks.[Footnote 2]

Risk management is a deliberate process for determining risk: that is, 
how likely it is that a threat will harm an asset and how severe the 
consequences would be if the asset were harmed, and then deciding on 
and implementing actions to create a certain level of protection or 
preparedness. Risk management acknowledges that while risk generally 
cannot be eliminated, enhancing protection from known or potential 
threats can reduce it. A facility adopting this approach should 
document in a security plan the assets the facility is protecting as 
well as the likely adversaries and their capabilities (the threat), the 
probability that an adversary will attempt to threaten those assets and 
the consequences of the adversary succeeding (the risk), and the 
weaknesses that might allow an adversary to be successful (the 
vulnerability). The identified threats, risks, and vulnerabilities are 
used to design the physical security system. Because security systems 
cannot protect against all threats, the facility should also develop an 
incident response plan that clearly lays out the actions to be taken if 
an event occurs that exceeds the capability of the security system. The 
risk management process is ongoing; as new information develops or 
events occur, security is reevaluated and corrective actions are taken.

In August 2002, congressional concerns about the security of pathogens 
at the Plum Island Animal Disease Center arose when 71 employees of the 
contractor USDA had hired to operate and maintain the facility, LB&B 
Associates Inc., went on strike. You asked us to determine (1) the 
adequacy of security at Plum Island and (2) how well LB&B Associates 
performed from August 2002, the month that its workers went on strike, 
through January 2003. To address the first question, we visited Plum 
Island several times to gain an understanding of the work performed 
there, the operation of the facilities, and to examine the security 
measures and plans. We also spoke with officials from DHS, USDA, Sandia 
National Laboratories, the National Institutes of Health, the U.S. Army 
Medical Research Institute of Infectious Diseases, the Central 
Intelligence Agency, the Defense Intelligence Agency, the Federal 
Bureau of Investigation (FBI), USDA's Office of Inspector General, and 
government officials of localities near Plum Island. To address the 
second question we, among other things, reviewed LB&B Associates' 
contract; interviewed pertinent officials; and reviewed USDA's ratings 
of LB&B Associates' performance, the qualifications of its employees to 
perform certain tasks, and costs that LB&B Associates incurred, but we 
did not independently rate the contractor's performance. Before the 
administration of Plum Island transferred to DHS, we briefed USDA and 
DHS officials on our preliminary findings and made suggestions for 
improvement so that they could take immediate corrective measures. 
Additional details about our scope and methodology are contained in 
appendix I.

Results in Brief:

Security at the Plum Island Animal Disease Center has improved, but 
fundamental concerns remain. Before the September 2001 terrorist 
attacks, officials at the Plum Island Animal Disease Center were less 
conscious of security and focused primarily on the safety of research 
activities and operations. Immediately after the attacks, USDA began a 
concerted effort to assess security at many of its laboratories, 
including Plum Island. Using a risk management approach that Sandia had 
suggested, USDA identified certain pathogens as the primary asset 
requiring protection, the potential threats to this asset, and the 
associated risk. USDA also began steps to upgrade security, some of 
which DHS has continued. For example, USDA hired armed guards to patrol 
the island and installed fingerprint recognition locks on freezers 
containing pathogens. Despite such improvements, we identified 
shortcomings in Plum Island's security arrangements.

First, Plum Island's physical security is incomplete and limited. For 
example, the alarms and door sensors that Sandia recommended for the 
biocontainment area are not fully operational. Our Office of Special 
Investigations also identified shortcomings such as inadequate lighting 
to support the security cameras outside the research complex. Moreover, 
USDA did not provide sufficient physical security for certain assets, 
including the foot-and-mouth disease vaccine bank, and assets critical 
to the continued operation of the facility. DHS officials agree that 
alarms and door sensors for the biocontainment area are important and 
anticipate that they will be in place by December 2003. DHS officials 
also told us they are in the process of evaluating other physical 
security decisions made by USDA. We are recommending actions to correct 
Plum Island's physical security deficiencies.

Second, Plum Island officials have not adequately controlled access to 
the pathogens. For example, in an effort to continue its mission, USDA 
permitted eight scientists from other countries access to the 
biocontainment area without being escorted, despite incomplete 
background checks. In addition, background checks are not conducted on 
students who regularly attend classes within the biocontainment area. 
According to the FBI, allowing anyone involved with pathogen-related 
activities--and, in particular, scientists from other countries--
access to the biocontainment area without a completed background 
investigation represents a significant security risk. Furthermore, not 
all individuals entering the biocontainment area for the purpose of 
performing nonlaboratory functions, such as cleaning, have been 
escorted as required by regulations. DHS officials expressed concerns 
about this issue and said they are reviewing USDA policies and 
practices. Finally, controlling access to the pathogens is particularly 
important because no security device is currently capable of detecting 
a microgram of pathogenic material. Therefore, a scientist at Plum 
Island, or any other laboratory, could remove a tiny quantity of 
pathogen without being detected and potentially develop it into a 
weapon. This condition is common to all facilities performing 
biological research. Although this risk may always exist, DHS could 
consult with other laboratories working with pathogens to learn about 
their different approaches for mitigating this risk. For example, at 
the U.S. Army Medical Research Institute of Infectious Diseases, 
background checks are required to be updated regularly to evaluate the 
continued suitability and reliability of employees working with 
pathogens. DHS officials agree that additional measures could help 
safeguard the pathogens at Plum Island and stated that they have taken 
responsibility for performing background checks on all scientists prior 
to being admitted to the biocontainment area and added escorts. We are 
recommending actions to further limit access to pathogens and to 
identify ways to mitigate the inherent difficulty of securing 
pathogens.

Third, Plum Island's incident response capability has limitations. For 
example, the guard force on Plum Island has been operating without 
authority from USDA to carry firearms or to make arrests. Until this 
authority is provided, local law enforcement officials said they are 
reluctant to help address criminal situations on the island. In 
addition, Plum Island officials have never specified how long they 
believe it should take for local law enforcement to respond to 
incidents. Moreover, Plum Island's incident response plan does not 
address what to do in the event of an incident that exceeds the 
capability of the security system, such as a terrorist attack. Finally, 
Plum Island officials have not tested the facility's response 
capability to ensure its effectiveness. DHS officials said they have 
started to take actions to fully address these incident response issues 
and are obtaining assistance from the Federal Protective Service. We 
are recommending that DHS officials enhance Plum Island's incident 
response capability.

Fourth, the risk that an adversary might try to steal pathogens is, in 
our opinion, higher than USDA believed it to be in 2001, when it 
defined the same risks for all of its laboratories, including Plum 
Island. USDA considered the risk that an adversary would try to steal 
pathogens from any of its laboratories to be relatively low compared to 
materials found at other laboratories, such as nuclear material or 
pathogens of a higher consequence to the human population. Since that 
time, however, the level of risk at Plum Island has increased because 
of the strike that occurred in August 2002 and the hostility 
surrounding it. For example, one striker has been convicted of 
tampering with the island's water distribution and treatment system as 
he walked off the job the day the strike began. USDA officials suspect 
that this individual did not act alone. The intelligence community 
considers disgruntled employees to be threats who pose a security risk. 
Although USDA did consider the possibility of a disgruntled worker when 
planning security for all of its laboratories, it did not reevaluate 
the level of risk, the assets requiring protection, or its incident 
response plans for Plum Island in light of specific events related to 
the strike. Furthermore, Sandia had originally recommended that USDA 
review the defined threats with the intelligence community and local 
law enforcement officials to ensure that threats particular to Plum 
Island and its vicinity were taken into consideration, but this was 
never done. FBI and Suffolk County officials told us that they consider 
this step to be very important because if there are such threats, 
federal and local officials may know of their existence and the risks 
they pose to the Plum Island Animal Disease Center. DHS officials told 
us they recognize the importance of working with local law enforcement 
and the intelligence community in order to better identify the threats 
relevant for planning security for Plum Island. We are recommending 
that DHS reconsider the risks and threats to Plum Island and revise the 
security and incident response plans as needed.

Regarding the contractor's performance, despite a decline from the 
previous rating period, USDA rated LB&B Associates' performance as 
superior for the rating period during which the strike occurred. Also, 
as a result of the strike, LB&B Associates exceeded its estimated 
budget by about $511,000, or approximately 5 percent, for fiscal year 
2002 and the first quarter of fiscal year 2003. USDA was aware of and 
approved the cost increases.

We provided DHS and USDA with a draft of this report for their review 
and comment. Both agencies provided written and clarifying oral 
comments. The agencies also provided technical comments, which we 
incorporated into the report as appropriate. DHS agreed with the report 
and stated that it has started to implement our recommendations. USDA 
stated that the report was very useful, but raised several concerns. 
For example, USDA stated that it appropriately used armed guards on 
Plum Island. Our concern is that USDA employed armed guards without 
ensuring that they had appropriate authority from USDA to carry 
firearms or make arrests. Furthermore, USDA had not developed a policy 
for instructing its guards on Plum Island about when and how they could 
use force, including the firearms they were carrying. DHS stated that 
it is working to resolve these issues.

Background:

Plum Island is a federally owned 840-acre island off the northeastern 
tip of Long Island, New York. It is about 1.5 miles from Orient Point, 
New York (see fig. 1), and about 12 miles from New London, Connecticut. 
Access to Plum Island is by a ferry service operated by a contractor 
that transports employees from Orient Point and Old Saybrook, 
Connecticut.

Figure 1: Plum Island, New York:

[See PDF for image]

[End of figure]

The U.S. Army used Plum Island during World War II as a coastal defense 
artillery installation until it was declared surplus property in 1948. 
In 1952, the U.S. Army Chemical Corps constructed a biological research 
laboratory, but it was never used. Then, in response to a foot-and-
mouth disease outbreak in Canada, the Congress transferred all of Plum 
Island to USDA in 1954 for the purpose of researching and diagnosing 
animal diseases from other countries, including foot-and-mouth disease, 
which has not been seen in the United States since 1929.

Foot-and-mouth disease is the most feared foreign animal disease 
because it is highly contagious and can have serious effects on the 
economy. Slaughtering susceptible animals and quarantining both animals 
and humans in affected areas helps limit the spread of the disease, but 
it can, nevertheless, have devastating economic consequences, as 
demonstrated during the 2001 outbreak in the United Kingdom. By the 
time the disease was eradicated, about 8 months later, the United 
Kingdom had slaughtered over 4 million animals and sustained losses of 
over $5 billion in the food and agricultural industries, as well as 
comparable losses in tourism.[Footnote 3]

Many other types of animal diseases are also studied at the Plum Island 
Animal Disease Center, such as classical swine fever; rinderpest; and a 
variety of pox viruses, including goat, camel, and deer pox. Some of 
the diseases are caused by pathogens that are zoonotic--that is, they 
can infect, and possibly cause death, in both animals and humans. 
Zoonotic pathogens maintained at Plum Island Animal Disease Center 
include West Nile virus, Venezuelan equine encephalitis, Rift Valley 
fever, and vesicular stomatitis. Because of the importance of the 
livestock industry to the U.S. agricultural sector and economy, 
protecting livestock from these diseases is an important 
responsibility.

To prevent pathogens from escaping the Plum Island Animal Disease 
Center and infecting livestock, wildlife, or humans, all research is 
conducted within a specially designed and sealed biocontainment area 
within the research facility that adheres to specific safety 
measures.[Footnote 4] For example, the biocontainment area has air 
seals on its doors and operates with negative air pressure so that air 
passes through a special filter system before leaving the facility. In 
addition, employees and visitors must change into protective clothing 
before entering the biocontainment area and shower when going between 
rooms containing different animal diseases and before leaving the 
biocontainment area. USDA's procedures require all people and material 
leaving the biocontainment area to be decontaminated.

The Plum Island Animal Disease Center's biocontainment area totals 
approximately 190,000 square feet, and it is unusual because it houses 
a laboratory facility with 40 rooms for large animals. The three-level 
laboratory also contains the machinery, such as the air filtration 
system, necessary for the biocontainment area to function, and the 
pathogen repository. Individuals entering the biocontainment area have 
access to all three floors. In contrast, biocontainment areas of other 
laboratories usually consist of a series of smaller rooms, housing 
smaller laboratory animals, making it easier to control access to the 
pathogens.

As a result of the September 11, 2001, terrorist attacks, Plum Island 
Animal Disease Center is now required to abide by new laws and 
regulations that were generated to help reduce the possibility of 
bioterrorism. These laws and regulations limit access to pathogens to 
only approved individuals--those whom USDA has identified as having a 
legitimate need to handle agents or toxins and whose names and 
identifying information have been submitted to and approved by the U.S. 
Attorney General. Specifically, the USA Patriot Act of 2001[Footnote 5] 
prohibits restricted people--such as criminals or those individuals 
from countries that the Department of State has declared to be state 
sponsors of terrorism--from shipping, receiving, transporting, or 
possessing certain dangerous pathogens. In addition, the Agricultural 
Bioterrorism Protection Act of 2002[Footnote 6] requires that USDA 
develop an inventory of potentially dangerous pathogens. Furthermore, 
individuals who possess or use pathogens must have background checks 
and must be registered with the U.S. Attorney General. Implementing 
this law are regulations that became effective on February 11, 
2003,[Footnote 7] which state that laboratories must be in compliance 
with the regulations by November 12, 2003. USDA also requires employees 
to have favorably adjudicated background investigations before working 
unescorted in the biocontainment area.[Footnote 8]

When USDA contracted with Sandia in October 2001, Sandia evaluated the 
effectiveness of security at the Plum Island Animal Disease Center and 
four other USDA laboratories. Using a risk management approach, USDA 
first identified generic lists of assets, risks, and threats for all 
five laboratories. Sandia then used USDA's generic threat definitions 
to assess the security and vulnerabilities at each laboratory. Sandia 
officials found that Plum Island's existing security system was 
inadequate for protecting against the generic threats that USDA had 
selected and that it required significant improvement. Sandia officials 
also found that the biocontainment building was not designed to be a 
highly secure facility. USDA and Sandia agreed, however, that modifying 
the facility to withstand an assault would be cost-prohibitive and 
that, because pathogens occur naturally and are available at other 
laboratories throughout the world, the risk that a terrorist would try 
to steal them from Plum Island was not perceived as significant (and 
their perception has not changed). Consequently, Sandia recommended a 
limited physical security system designed to deter and detect a 
security breach and, with assistance from local law enforcement, 
respond to incidents exceeding the capability of the guard force on the 
island.

DHS assumed formal administration of Plum Island from USDA on June 1, 
2003, as provided by the Homeland Security Act of 2002. During a 
transition period that will last until October 1, 2003, DHS will review 
USDA's policies and procedures and determine how best to administer the 
functions of Plum Island. Until the transition is complete, DHS will 
administer the facility under the same policies and regulations 
established by USDA. Ultimately, the two agencies will work together to 
address national biodefense issues and carry out the mission of the 
Plum Island Animal Disease Center. While DHS is now formally 
responsible for security, scientists and support staff of two USDA 
agencies, the Agricultural Research Service (ARS) and the Animal and 
Plant Health Inspection Service (APHIS), will continue to implement the 
Plum Island Animal Disease Center's research and diagnostic mission. 
ARS scientists at Plum Island are responsible for research on foreign 
livestock diseases, while APHIS scientists are responsible for 
diagnosing livestock diseases. APHIS conducts diagnostic training 
sessions several times a year to give veterinary health professionals 
the opportunity to study the clinical signs of animal diseases found in 
other countries, such as foot-and-mouth disease. According to USDA, 
scientists from other countries are an integral part of the Plum Island 
Animal Disease Center's workforce because they are well qualified and 
well situated to study the diseases researched there, many of which are 
endemic to their own countries. These scientists are sponsored by USDA 
and obtain visas that permit them to work for the department.

DHS currently uses USDA's independent contractor to carry out 
operations and maintenance functions for Plum Island. The services 
under the contract include, among other activities, operating the 
ferries, providing security and emergency fire and medical services, 
providing buildings and grounds services, meeting utility requirements, 
and performing custodial functions. On August 13, 2002, 71 of these 
employees went on strike. The contractor at that time, LB&B Associates, 
was responsible for handling the strike. On January 6, 2003, LB&B 
Associates' contract expired. USDA had initially awarded that contract 
under a small business program when LB&B Associates still qualified as 
one. Since that initial award, LB&B Associates had grown so that it no 
longer was eligible to compete for contracts set aside for small 
businesses. As a result, USDA awarded the new contract to North Fork 
Services, a joint venture between LB&B Associates and Olgoonik 
Logistics LLC, a small minority company of Anchorage, Alaska. Under 
this arrangement, the more experienced LB&B Associates serves as a 
mentor to North Fork Services, and most of the employees who worked for 
LB&B Associates continue to work for North Fork Services. DHS officials 
told us that they would not renew the contract with North Fork 
Services. DHS stated that the current terms and scope of the contract 
are insufficient to operate the facility in accordance with its view of 
the standards and mission of the Plum Island Animal Disease Center.

USDA Has Taken Strides To Improve Security at Plum Island, but 
Fundamental Concerns Remain:

Before the September 2001 terrorist attacks, the Plum Island Animal 
Disease Center, like many other federal laboratories, was less 
conscious of security and focused primarily on the safety of its 
programs and operations. Since then, USDA intensified its focus on 
security and has taken strides in developing and installing a security 
system. However, Plum Island remains vulnerable to security breaches 
because its security arrangements are incomplete and limited.

USDA Has Taken Strides To Improve Security at Plum Island:

Security at Plum Island has improved since the fall of 2001. USDA hired 
a physical security specialist to oversee its efforts to improve 
security, including the implementation of Sandia's recommendations, and 
to provide direction for the security measures being taken for Plum 
Island.[Footnote 9] As of July 2003, completed security upgrades 
include the following:

* taking measures to prevent unauthorized access to Plum Island by 
allowing only sponsored visitors on the ferry and island; identifying 
those sponsored individuals, and allocating passes, when they board the 
ferry; and staffing Orient Point, New York, with a security guard as 
well as installing an access gate that can be opened only with an 
identification card assigned to Plum Island federal personnel;

* hiring armed guards to patrol the island and observe personnel and 
visitors entering and leaving the facility. When the nation is on high 
terrorist alert (code orange) armed guards are added to monitor access 
to the biocontainment area and to better secure the island's perimeter. 
This also allows armed guards to remain in the building while the other 
armed guards go to the harbor to inspect vehicles unloaded from the 
ferry and ensure that individuals departing the ferry onto Plum Island 
have permission to be there;

* conducting a background check for government staff and contractors 
working on the island and performing more rigorous checks for 
individuals with access to the pathogens;

* installing some video cameras to (1) increase the probability of 
timely detection of an intruder and (2) monitor the activities of those 
inside the biocontainment area when they remove pathogens from the 
storage area--or the repository;

* installing intrusion detection alarms in the administrative building 
and the biocontainment area;

* limiting access to pathogens by installing certain access control 
devices; and:

* improving pathogen control and accountability by completing and 
maintaining an inventory of pathogens at the facility, submitting names 
of those with access to pathogens to the U.S. Attorney General, and 
creating security and incident response plans, as required by law.

Despite Improvements, Security Arrangements at Plum Island Are 
Incomplete and Have Serious Limitations:

Although security at the Plum Island Animal Disease Center has improved 
over the past few years, fundamental concerns remain.

Plum Island's Physical Security Is Incomplete and Limited:

Plum Island's physical security system is not yet fully operational. 
For example, the facility does not yet have in place all the equipment 
necessary to detect intruders in various places. DHS officials agree 
that these physical security measures are important and anticipate they 
will be in place by December 2003.

In addition, our Office of Special Investigations identified physical 
security limitations. For example, we found that lighting is inadequate 
to support the cameras outside of the research complex and vehicles are 
not properly screened. (See app. II for other limitations identified by 
our Office of Special Investigations and observations on how they could 
be addressed.):

Moreover, the physical security measures that USDA chose to implement 
on Plum Island are largely limited to the biocontainment area, where 
pathogens are located. Consequently, other important assets remain 
vulnerable. For example, the continued operation of the Plum Island 
Animal Disease Center is dependent on its infrastructure, which has 
limited protection. Protecting the infrastructure is particularly 
important because the Plum Island Animal Disease Center is the only 
facility in the United States capable of responding to an outbreak and 
researching foot-and-mouth disease. Therefore, if the infrastructure 
was damaged, no other facility could step in and continue this foot-
and-mouth disease work.[Footnote 10] Furthermore, Plum Island is the 
only facility in North America that has a foot-and-mouth disease 
vaccine bank. This bank represents years of cooperative research 
performed by Canada, Mexico, and the United States, yet the room 
containing it has a window opening covered with only plywood. USDA 
officials said they intend to improve the physical security of the 
vaccine bank but have not yet decided on the approach to take. In 
addition, DHS officials agree that the Plum Island Animal Disease 
Center is vital to combating bioterrorism, and they are evaluating the 
physical security on Plum Island.

Access to Pathogens Is Not Adequately Controlled:

Access to pathogens at the Plum Island Animal Disease Center is not 
adequately controlled. For example, as of July 2003, eight scientists 
from other countries were working in the biocontainment area without 
completed background investigations.[Footnote 11] According to FBI 
officials, allowing anyone who does not have a completed background 
investigation access to the biocontainment area--in particular, a 
scientist from another country--represents a significant security risk. 
USDA officials told us these scientists were allowed into the 
biocontainment area to enable research to continue. Furthermore, they 
stated that background investigations had been initiated for these 
individuals, and it was assumed that these scientists were being 
escorted, which USDA policy permits for those with pending background 
investigations. However, Plum Island officials told us that due to 
resource constraints, it has not been possible to continually escort 
and monitor scientists while they are in the biocontainment area. When 
we brought this concern to the attention of DHS officials, they told us 
they are developing a more restrictive policy for allowing scientists 
from other countries to have access to pathogens.

In addition, USDA policy does not require background checks on students 
who attend the foot-and-mouth disease classes that are regularly held 
in the biocontainment area. In 2002, USDA held six classes with an 
average of 32 students per class and anticipates continuing these 
classes in the future. According to USDA's policy, individuals may 
enter the biocontainment area without background checks if an approved 
individual escorts them.[Footnote 12] We believe this policy warrants 
reconsideration for several reasons.

* Allowing students who do not have background checks into 
biocontainment for purposes of attending foot-and-mouth disease 
classes, with or without an approved escort, may not be consistent with 
the regulations[Footnote 13] implementing the Agricultural 
Bioterrorism Preparedness Act.

* These same regulations do not provide an exception for unapproved 
students or other visitors who may be handling or have access to 
pathogens.

* USDA officials told us that maintaining constant visual contact with 
even one escorted individual is very difficult because of the size and 
floor plan of the biocontainment area.

USDA officials told us that they believe escorting students is 
sufficient to meet the intent of the regulations. However, DHS 
officials said that all students should have completed background 
checks before entering the biocontainment area and told us they will 
develop a policy that will ensure that this occurs once the transition 
period is complete.

Although USDA's regulations specifically allow unapproved individuals 
into the biocontainment area with an approved escort, we found 
unescorted maintenance workers in the biocontainment area. The 
regulations provide for unapproved individuals to conduct routine 
cleaning, maintenance, repair, and other nonlaboratory functions in the 
biocontainment area if they are escorted and continually monitored by 
an approved individual.[Footnote 14] However, early in our 
investigation we found that as many as five such individuals were 
working in the biocontainment area without escorts. When we brought 
this to the attention of USDA officials, they provided an escort for 
these individuals. DHS officials added that the operating contractor 
would soon provide security escorts.

Controlling access to pathogens is important because no security device 
can currently ensure that an insider, such as a scientist, will not 
steal pathogens from the Plum Island Animal Disease Center or other 
laboratories. According to the director of the Plum Island Animal 
Disease Center--while under USDA's administration--and officials from 
Sandia, the National Institutes of Health, and the U.S. Army Medical 
Research Institute of Infectious Diseases, pathogens are more difficult 
to secure than other materials that could be used as weapons, such as 
nuclear material. This is because there is no existing mechanism 
capable of detecting the theft of a microgram of pathogenic material 
and a tiny quantity can be multiplied. Thus, a scientist could covertly 
generate or divert a pathogen during the normal course of work, remove 
it from the laboratory undetected, and potentially develop it into a 
weapon for spreading disease. This inherent problem leaves all 
facilities with pathogens vulnerable to serious security breaches. 
Also, the existence of the foot-and-mouth disease pathogen at the Plum 
Island Animal Disease Center is a particular concern because an 
undetected theft, followed by the spread of the disease, would have 
serious economic consequences for the nation. In addition, the presence 
of zoonotic diseases at the Plum Island Animal Disease Center is 
worrisome because of the potential for adverse health affects on 
humans, and two such pathogens are of particular concern. First, U.S. 
government research has shown that Venezuelan equine encephalitis virus 
can be developed into a human biowarfare agent. Second, USDA believes 
that because of the genetic similarities of two pox strains, it may be 
possible to manipulate camel pox into an agent as threatening as 
smallpox.[Footnote 15] Although USDA created an inventory list of the 
pathogens at the Plum Island Animal Disease Center, as required by law, 
such a list cannot provide an accurate count of pathogens because 
quantities of pathogens change as they replicate.

Thus far, Plum Island officials have secured pathogens by restricting 
access to the island itself and to the biocontainment area where the 
pathogens are located and by locking the freezers containing the 
pathogens. But DHS officials have not yet had the opportunity to fully 
consider actions other laboratories are taking to mitigate the 
likelihood that pathogens could be stolen. Officials at the U.S. Army 
Medical Research Institute of Infectious Diseases at Fort Detrick, 
Maryland, told us they are taking several steps, in addition to 
physical security measures and inventory control, to better safeguard 
pathogens against theft. For example, they plan to use trained 
personnel as roving monitors to ensure that unauthorized laboratory 
work is not being performed, and they will randomly inspect all 
personnel exiting laboratories. Moreover, they are interviewing 
scientists periodically and requiring that background checks be updated 
every 5 years in order to evaluate the continued suitability and 
reliability of those employees working with pathogens. Although USDA 
told us background checks were updated every 5 years, according to Plum 
Island records as of July 2003, 12 current Plum Island employees, some 
of whom have access to pathogens, had not had their background checks 
updated in more than 10 years. According to Sandia, other potentially 
helpful safeguards include creating, implementing, and enforcing strict 
policies, including those that prohibit researchers from continuing 
work in the biocontainment area if they do not follow security 
procedures. DHS officials stated that they have started to work with 
other laboratories and that measures such as these, while not 
necessarily a panacea, could help improve the security of pathogens at 
Plum Island.

Incident Response Capability Is Limited:

Plum Island's incident response capability is limited in four ways. 
First, the security guards on each shift carry firearms, although Plum 
Island does not have statutory authority for an armed guard 
force.[Footnote 16] USDA operated the guard force on Plum Island 
without authority for the guards to carry firearms or make arrests. 
Furthermore, Plum Island officials have not approved a policy that 
addresses the use of weapons, and, as a result, the guards do not know 
specifically how they are expected to deal with intruders on the island 
and when or if they should use their weapons.[Footnote 17]

When we informed DHS officials of these problems, they agreed to 
resolve them as soon as possible and raised the possibility that the 
Federal Protective Service[Footnote 18] could be assigned to guard Plum 
Island. The Federal Protective Service, now under DHS, has the 
authority to carry weapons and make arrests.[Footnote 19] Since DHS has 
taken responsibility for the island, the Federal Protective Service has 
visited Plum Island to assess its security requirements.

Second, according to the observations of our Office of Special 
Investigations, Plum Island has too few guards to ensure safety and 
effectiveness.[Footnote 20] DHS officials agree with this observation 
and said that they have requested funds to hire additional guards.

Third, arrangements for local law enforcement support are also limited. 
According to Sandia's recommended security plan, in the event an 
incident exceeds the response capability of the Plum Island guards, 
they would first contact Southold town police, the closest and primary 
responding law enforcement agency.[Footnote 21] If still more resources 
were needed, Southold town police would contact Suffolk County police, 
the secondary responder. Because of liability issues, however, 
arrangements with local law enforcement have not been finalized even 
though there have been continuing discussions with local law 
enforcement. The result is that Plum Island officials cannot predict 
the extent to which the Southold town police will provide backup during 
an incident. On the other hand, officials of Suffolk County, which 
includes both Plum Island and Southold, told us that although it takes 
longer for them to respond than Southold police, they could respond 
with an adequate number of officers, if necessary.[Footnote 22] In 
addition, they have requested a map of the island and a tour of the 
biocontainment area to become more knowledgeable about the facility and 
its surrounding terrain. Suffolk County officials pointed out, however, 
that, for geographical reasons, Southold remains the primary responder. 
In this vein, Plum Island officials have never defined an adequate 
response time, nor have they conducted exercises with local law 
enforcement officials to determine how effectively Plum Island and 
local officials can address an incident on the island. DHS officials 
agree that the arrangements for local law enforcement support are 
limited, and they are trying to overcome this problem as quickly as 
possible by first resolving the issue surrounding the authority to make 
arrests and carry weapons. In addition, these officials concur that it 
is important to develop a better understanding of the response times 
and capabilities of local law enforcement assistance and to conduct 
exercises to test the adequacy of arrangements once they are completed.

Fourth, according to Sandia officials, the incident response plan for 
Plum Island is not sufficiently comprehensive. Plum Island's incident 
response plan contains certain elements required under law, such as how 
to respond to an inventory violation or a bomb threat.[Footnote 23] 
However, because USDA selected a risk management approach to security, 
Plum Island officials need an incident response plan that clearly lays 
out the actions to be taken if events occur that exceed the capability 
of the facility's security system. For example, Plum Island officials 
do not have a road map for actions to be taken in the event of a 
terrorist attack--who gets notified, in what order, and the 
responsibilities of staff for responding. This is a critical 
shortcoming because, according to DHS, the nation faces a significant 
risk of a terrorist attack. Sandia officials also said that the 
incident response plan for Plum Island requires significant additional 
development to properly prepare for the complete range of threats. 
Moreover, the incident response plan does not identify the security 
steps that should be taken in the event of an outbreak of foot-and-
mouth disease or take into consideration any increased risks to the 
facility, which could severely impede the nation's capability to 
contain an outbreak.

Finally, according to the FBI and local law enforcement officials, the 
island's incident response plan may need to be coordinated with the 
incident response plans of such nearby facilities as the Millstone 
nuclear power plant, the Brookhaven National Laboratory, and the 
laboratories at the State University of New York at Stony Brook because 
a terrorist attack on any of these facilities could also involve Plum 
Island.[Footnote 24] This type of coordination has not yet taken place. 
DHS officials agree that the incident response plan needs to be more 
comprehensive and coordinated with national and local law enforcement 
agencies.

Plum Island's Security Plan Does Not Address All Risks and Threats:

The risk that an adversary might try to steal pathogens is, in our 
opinion, higher than USDA believed it to be in 2001, when it defined 
the same risks for all of its laboratories, including Plum Island. USDA 
considered the risk that an adversary would try to steal pathogens from 
any of its laboratories to be relatively low compared to materials 
found at other laboratories, such as nuclear material or pathogens of a 
higher consequence to the human population. Since its evaluation in 
2001, however, the level of risk at Plum Island has increased because 
of the strike that occurred in August 2002 and the hostility 
surrounding it. For example, one striker has been convicted of 
tampering with the island's water distribution and treatment system as 
he walked off the job the day the strike began.[Footnote 25] USDA 
officials suspect that this individual did not act alone. In addition 
to this incident, USDA asked the FBI and USDA's Office of Inspector 
General to investigate the possibility that a boat engine had been 
tampered with. USDA also asked the FBI to investigate why backup 
generators failed to come on when Plum Island lost power for more than 
3 hours in December 2002.

After the backup generators failed to provide power, New York's ABC 
news station broadcast an interview with a disguised worker, at that 
time employed at Plum Island, who discussed his unhappiness with USDA 
and the contractor and blamed replacement workers for the power 
outage.[Footnote 26] In addition, several of the striking workers 
returned to work for LB&B Associates and are still employed on the 
island under the new contractor, North Fork Services. In response to 
the strike, USDA prevented striking workers from accessing Plum Island 
and it added guards at Orient Point to assure the security of employees 
as they were arriving and departing near the union picket line. 
However, USDA did not reevaluate the level of risk, the assets 
requiring protection, or its incident response plans in light of the 
strike and accompanying sabotage. USDA believed that this was not 
necessary because its security plan anticipated a disgruntled worker at 
any of its laboratories. We disagree because there is a difference 
between addressing security problems caused by one employee and 
addressing the hostilities resulting from the strike, which could 
include several employees working together. We believe that the 
implications of a disgruntled work force should be taken into account 
when reevaluating the extent of risks, threats, and assets requiring 
increased security.

Furthermore, Sandia had originally recommended that USDA review the 
defined threats with the intelligence community and local law 
enforcement officials to ensure that threats particular to Plum Island 
and its vicinity were taken into consideration, but this was never 
done.[Footnote 27] FBI and Suffolk County officials told us that they 
consider this step to be very important because if there were such 
threats, federal and local officials may be aware of them and the risks 
they pose to the Plum Island Animal Disease Center. In addition, if 
local law enforcement entities were involved in planning Plum Island's 
security, they would be in a better position to respond to incidents on 
the island.

DHS officials agree that rehiring workers who walked off the job could 
be problematic but told us they are under pressure from the local 
chapter of the union and the community to rehire those who lost their 
jobs as a result of the strike. DHS officials also said they recognize 
the importance of working with local law enforcement and the 
intelligence community to better define the threats and associated 
risks for Plum Island.

USDA Concluded Its Contractor's Performance Declined during the Strike 
but Operations Continued and Overall Performance Was Superior:

Regarding the contractor's performance, despite a decline from the 
previous rating period, USDA rated LB&B Associates' performance as 
superior for the rating period during which the strike occurred. When 
the strike occurred, LB&B Associates, with the assistance of USDA 
employees, maintained operations at Plum Island. For example, LB&B 
Associates implemented a strike contingency plan, brought in qualified 
individuals from its other work sites, and hired subcontractors with 
the required licenses and certifications to operate certain Plum Island 
facilities and its boats. Also, as a result of the strike, LB&B 
Associates exceeded its estimated budget by about $511,000, or 
approximately 5 percent, for fiscal year 2002 and the first quarter of 
fiscal year 2003. USDA was aware of and approved the cost increases. 
Further information about LB&B Associates' performance, employee 
qualifications, and costs is contained in appendix III.

Conclusions:

Despite improvements, security arrangements at Plum Island are not yet 
sufficient. Further actions are needed to provide reasonable assurance 
that pathogens cannot be removed from the facility and exploited for 
use in bioterrorism. Until DHS fully implements the physical security 
measures and addresses those vulnerabilities identified by our Office 
of Special Investigations, Plum Island's security system will not 
provide physical security commensurate with the importance of the 
facility. Additionally, the Plum Island Animal Disease Center will 
remain more vulnerable than it needs to be if the physical 
infrastructure that supports it is not afforded better protection. 
Similarly, it is important to better secure the foot-and-mouth disease 
vaccine bank to ensure its availability for combating an outbreak. 
Also, the lack of comprehensive policies and procedures for limiting 
access to pathogens unnecessarily elevates the risk of pathogen theft. 
Moreover, because physical security measures alone are not adequate to 
secure pathogens, all laboratories containing these materials face the 
challenge of developing other approaches to mitigate the risk of theft. 
By consulting with other laboratories to discover methods they are 
using to mitigate the risk to pathogens, Plum Island officials can 
learn more about safeguards being employed elsewhere. Furthermore, Plum 
Island officials cannot effectively respond to security breaches until 
DHS resolves issues that impede Plum Island's response capability, such 
as the authority of the guard force to make arrests, which makes it 
difficult for the guards and local law enforcement agencies to address 
criminal situations on the island. Finally, because we believe the 
level of risk at Plum Island is higher than USDA originally determined, 
and because USDA did not validate threats with intelligence agencies or 
local law enforcement officials, DHS cannot be assured that Plum 
Island's security, including its physical security system and response 
plans, is sufficient to address the full range of events that could 
occur on the island.

Recommendations for Executive Action:

To complete and enhance Plum Island's security arrangements, we 
recommend that the Secretary of Homeland Security, in consultation with 
the Secretary of Agriculture, do the following:

* Correct physical security deficiencies by (1) fully implementing the 
physical security measures, (2) addressing the specific security 
shortcomings identified by our Office of Special Investigations, (3) 
better securing certain features of the physical infrastructure that 
supports the continued operation of the Plum Island Animal Disease 
Center, and (4) better securing the foot-and-mouth disease vaccine 
bank.

* Limit access to pathogens by further developing and enforcing 
specific procedures, including internal control checks, to ensure (1) 
that all individuals involved in laboratory activities in the 
biocontainment area--including students and regardless of citizenship-
-have been approved, in accordance with the law; (2) that background 
checks of these individuals are updated regularly; and (3) that 
cleaning, maintenance, and repair staff entering the biocontainment 
area are escorted at all times by individuals with completed background 
checks.

* Consult with other laboratories to identify ways to mitigate the 
inherent difficulty of securing pathogens.

* Enhance incident response capability by (1) resolving the issue of 
the guards' authority to carry firearms and make arrests; (2) 
developing and implementing a policy on how guards should deal with 
intruders and use weapons; (3) increasing the size of the guard force; 
(4) completing an agreement with local law enforcement agencies to 
ensure backup assistance when needed; (5) defining an adequate response 
time for law enforcement to respond to incidents; (6) developing an 
incident response plan that includes precise detail about what to do in 
the event an incident occurs that exceeds the capability of the 
security system, such as a terrorist attack; and (7) conducting 
exercises with local law enforcement to test the efficiency and 
effectiveness of Plum Island's response capability.

* Reconsider the security risks at Plum Island, taking into account 
recent acts of disgruntled employees.

* Consult with appropriate state and local law enforcement and 
intelligence agencies to revisit the threats specific to the Plum 
Island Animal Disease Center.

* Revise, as necessary, security and incident response plans to reflect 
any redefined, risks, threats, and assets.

Agency Comments:

We provided DHS and USDA with a draft of this report for their review 
and comment. Both agencies provided written and clarifying oral 
comments. The agencies also provided technical comments, which we 
incorporated into the report as appropriate. Overall, DHS agreed with 
the report and stated that it has started to implement our 
recommendations, and USDA stated that the report was very useful but 
also raised several concerns.

In its written comments (see app. IV), DHS agreed that fundamental 
concerns leave the facility vulnerable to security breaches and stated 
that the report is factually accurate. DHS also commented that it 
accepts and supports our recommendations. In addition, DHS stated that 
since it assumed administrative responsibility for Plum Island on June 
1, 2003, it has taken the following actions, among others, to address 
the recommendations in this report:

* DHS is working with USDA to develop corrective actions to address the 
physical security deficiencies identified in our report.

* DHS is working with USDA to develop an access control policy for all 
personnel who are required to enter the biocontainment area.

* DHS is working with other federal agencies to develop security 
policies and procedures to limit access to pathogens.

* DHS is working with the Federal Protective Service to enhance 
security at the facility and bring arrest and detention authority to 
the island. In addition, DHS stated that funds have been requested to 
increase the guard force.

* DHS is working with local law enforcement agencies to coordinate 
incident response plans, mutual aid agreement requirements, and joint 
exercises to test security response capabilities.

* DHS is reviewing the island's entire security plan and will revise 
the threat assessment as necessary. DHS stated that it expects to 
complete this assessment in early 2004.

In its written comments (see app. V), USDA addressed several aspects of 
our report. These specific comments and our responses follow.

* USDA suggested that the report should make judgments about the need 
for enhanced security against a risk assessment-based approach that 
considers both the probability and the consequences of specific types 
of attacks. However, as we report, DHS is now responsible for 
performing such an assessment, and DHS stated that it has undertaken a 
review of USDA's threat statement, which it will complete early in 
2004. Our objective was to evaluate the status of security on Plum 
Island. That evaluation included, among other steps, a review of USDA's 
risk-based security plan for Plum Island and its implementation. Our 
report details substantive flaws in both the planning and the execution 
of that plan.

* USDA also commented that the report did not recognize that USDA had a 
contract to improve security at Plum Island prior to September 11, 
2001. We added to the report that USDA contracted with the U.S. Army 
Corps of Engineers in 2000 to improve security at Plum Island, but 
noted that few of the Corps' recommendations had been implemented. 
Also, USDA officials told us that in light of September 11, 2001, and 
the subsequent dissemination of anthrax through the postal system, they 
made a concerted effort to improve security at USDA's laboratories. The 
officials added that Sandia was hired to provide USDA with a consistent 
approach to evaluating security at the department's major laboratories. 
Sandia officials told us that they did not agree with the approach 
taken by the Corps, and they concluded that Plum Island's existing 
security system was substantially inadequate for protecting against the 
threats that USDA defined as relevant.

* USDA indicated that it took various actions to safeguard pathogens in 
response to the strike. USDA stated that it increased and armed the 
guards on Plum Island; added guards at Orient Point, Long Island, where 
the strikers were picketing; and excluded the strikers from Plum Island 
facilities. We agree that USDA responded with immediate measures and 
have revised the report to reflect these steps. However, we believe 
that USDA's responses to the strike were insufficient. Although USDA 
increased the number of guards at Orient Point, this was a temporary 
measure primarily put in place to ensure the safety of the employees as 
they passed the union picket line. Also, Plum Island officials told us 
that the number of guards on Plum Island itself did not change as a 
result of the strike and that these guards had been armed since 2001. 
More importantly, USDA's comments do not recognize that there is a 
difference between addressing security problems caused by one employee 
and addressing the security problems resulting from the strike, which 
could include several employees collaborating to cause problems. We 
believe that the implications of having a disgruntled work force should 
be taken into account when reevaluating the extent of risks, threats 
and assets requiring increased security.

* USDA stated that it appropriately used armed guards on Plum Island 
and were in communication with local law enforcement. While we agree 
that armed guards are necessary for security on Plum Island, our 
concern is that the guard force did not have authority from USDA to 
carry firearms and make arrests. Furthermore, USDA never developed a 
policy instructing its guards when and how they could use force, 
including the firearms they were carrying. Plum Island officials said 
they were unable to resolve these important matters with USDA 
headquarters officials, including the Office of General Counsel. 
Finally, we noted in the report that while Plum Island officials have 
communicated with local law enforcement, no agreement was reached to 
assist Plum Island guards in the event a criminal act occurred on the 
island. DHS stated that it is working to resolve these issues.

* USDA stated that it is an accepted practice for a person with an 
appropriate background investigation to escort those who do not yet 
have a clearance. USDA also acknowledged that it had problems 
implementing its escort procedures at Plum Island but now believes its 
escort procedures are reliable. We agree that the practice of escorting 
is used in other laboratories that contain pathogens. However, Plum 
Island officials and scientists repeatedly told us that this procedure 
is not practical at Plum Island because of staffing considerations. For 
example, they explained that the escorts were Plum Island employees who 
had other duties, which compelled them to leave those they were 
escorting for periods of time. Furthermore, we believe that internal 
control checks should be established to ensure implementation of escort 
procedures, and we have added this to our recommendations. DHS 
commented that more will be done to address this issue--it is planning 
to develop, in concert with USDA, a limited use policy to identify 
access control requirements for all personnel who are required to enter 
the biocontainment area.

* USDA said that several of the employees we identified had not had 
their background checks updated in the last 5 years, but that some of 
those we identified had. We reported based on the actual records of 
background checks maintained at the Plum Island Animal Disease Center. 
We also recognize that there may be differences between the records 
maintained on the island and other USDA records, and that the 
background checks of several of these individuals may have been updated 
since the time of our review.

:

As we agreed with your office, unless you publicly announce the 
contents of this report earlier, we plan no further distribution of it 
until 30 days from the date of this report. We will then send copies of 
this report to the Secretaries of Homeland Security and Agriculture, 
appropriate congressional committees, and other interested parties. We 
will also make copies available at no charge on the GAO Web site at 
http://www.gao.gov.

If you have any questions about this report, please call me or Charles 
M. Adams at (202) 512-3841. Key contributors to this report are listed 
in appendix VI.

Sincerely yours,

Signed by:

Lawrence J. Dyckman 

Director, Natural Resources and Environment:

[End of section]

Appendixes: 

Appendix I: Scope and Methodology:

To determine the extent to which USDA has addressed security for Plum 
Island, we visited the facility several times to examine current 
physical security measures and to review plans for further security 
actions. In addition, two security experts from our Office of Special 
Investigations toured the facility to identify possible vulnerabilities 
and actions that could be taken to reduce them. We also reviewed 
numerous security documents, such as Sandia's assessment of Plum Island 
security; Plum Island's draft security and response plans; draft 
memorandums of understanding with local entities; physical security 
implementation plans; and policies and procedures for guards, 
employees, visitors, students, and others with access to pathogens. In 
addition, we worked closely with Sandia officials to understand how 
they applied a risk management security approach to Plum Island. We 
also interviewed numerous officials from Plum Island, including the 
physical security specialist, scientists, the center director, and 
others responsible for security changes under both the Agricultural 
Research Service and the Animal Plant and Health Inspection Service; 
officials of USDA's Offices of Homeland Security, Procurement and 
Property Management, and General Counsel; and officials of the 
Department of Homeland Security, which assumed the administration of 
Plum Island. To gain a better understanding of possible threats to Plum 
Island, we spoke with officials from the Federal Bureau of 
Investigation, Defense Intelligence Agency, Central Intelligence 
Agency, Suffolk County police and fire departments, and USDA's Office 
of Inspector General. To understand the cooperation between local 
governments and Plum Island that might be needed if an incident were to 
occur on the island, we interviewed government and law enforcement 
officials from Suffolk County, the town of Southold, and the village of 
Greenport. Finally, we toured the laboratories at and interviewed 
officials from the National Institutes of Health and the U.S. Army 
Medical Research Institute of Infectious Diseases to understand how 
they are handling security challenges since the terrorist attacks of 
2001. To determine Plum Island's compliance with new laws and 
regulations, we reviewed the USA Patriot Act[Footnote 28] of 2001, the 
Agricultural Bioterrorism Protection Act of 2002[Footnote 29] and its 
regulations that went into effect as a final interim rule on February 
11, 2003,[Footnote 30] as well as USDA's policies and procedures for 
security at biosafety level 3 facilities. We also considered the Office 
of Management and Budget's Circular A-123, Management Accountability 
and Control,[Footnote 31] and the standards in our Internal Control: 
Standards for Internal Control in the Federal Government. [Footnote 32]

To determine how well LB&B Associates performed from the time the 
strike began on August 13, 2002, to January 5, 2003, we (1) reviewed 
LB&B Associates' contract with USDA and identified LB&B Associates' 
performance requirements; (2) interviewed officials of USDA, LB&B 
Associates, and the International Union of Operating Engineers to get 
their perspective on LB&B Associates' performance; (3) reviewed USDA's 
ratings of LB&B Associates' performance since 1999 and, in particular, 
the Award Fee Determination Board's report on LB&B Associates' 
performance during the period the strike took place; (4) reviewed the 
qualifications of LB&B Associates employees, such as the boat operators 
and water distribution and treatment system operators, all of whom are 
required to meet certain qualifications for performing their duties; 
(5) analyzed 3 years of contract cost data provided by LB&B Associates 
to learn which items increased as a result of the strike; and (6) 
validated the contract cost data by spot-checking it against the bills 
LB&B Associates submitted to USDA. While we took these steps to 
determine how well LB&B Associates performed, we did not independently 
rate LB&B Associates' performance. In addition, we interviewed 
officials involved in investigating strike-related incidents, 
including officials of the Federal Bureau of Investigation and USDA's 
Office of Inspector General.

Our work was conducted in accordance with generally accepted government 
auditing standards from January through August 2003.

[End of section]

Appendix II: Additional Observations on Plum Island's Security System 
by GAO's Office of Special Investigations:

* The security force reports directly to the Administrative Contract 
Officer and not to the Security Director--it is important for the 
security force to report directly to the Security Director of Plum 
Island to ensure that security-related issues are handled promptly.

* There are no name checks or record checks given to contractors and 
visitors going into the biocontainment area. Contractors and visitors 
entering the biocontainment area could be checked for criminal charges 
(through the National Criminal Information Center) before they are 
granted access.

* The area outside of the biocontainment and administrative building is 
surveilled by stationary closed-circuit television cameras, which are 
insufficient. Installing pan, tilt, and zoom closed-circuit television 
cameras in certain areas would enhance surveillance capabilities.

* The island is easily accessible to the general public by boat, and 
there are limited "no trespassing" signs present on the island to 
advise the public that it is a government facility--more "no 
trespassing" signs in those areas of the island that are easily 
accessible to the public by boat would address this condition.

* In the event of a fire, Plum Island is not always able to respond 
appropriately because the fire brigade has limited hours of operation. 
The security force could be cross-trained for fire rescues and 
therefore provide 24-hour coverage.

* The building used for overnight accommodations lacks panic alarms for 
emergency response. Panic alarms could be installed in the building 
and, when visitors are present, security guards could drive by on a 
regular basis.

* Control for keys and master keys of the facility is deficient. The 
security department could be assigned the responsibility for all keys 
and master keys. A key log could be created to better track possession 
of keys.

[End of section]

Appendix III: LB&B Associates' Performance, Employee Qualifications, 
and Costs:

USDA concluded, in an evaluation of LB&B Associates' performance, which 
included the time period involving the strike, that LB&B Associates' 
overall performance was superior, although its performance had declined 
compared to prior rating periods. When the strike occurred, LB&B 
Associates, with the assistance of USDA employees, continued to perform 
and maintained operations at Plum Island. LB&B Associates implemented a 
strike contingency plan, brought in qualified individuals from its 
other work sites, and hired subcontractors with the required licenses 
and certifications to operate certain Plum Island facilities and its 
boats. Also, as a result of the strike, LB&B Associates exceeded its 
estimated budget by about $511,000, or approximately 5 percent, for 
fiscal year 2002 and the first quarter of fiscal year 2003. USDA was 
aware of and approved the cost increases.

Performance:

Although LB&B Associates' performance declined during the strike 
relative to previous rating periods, overall, LB&B Associates performed 
at a superior level during the evaluation period that included several 
months when workers were on strike, maintaining--and in some cases even 
improving--operations critical to the functioning of the island, 
according to Plum Island officials. Plum Island's Award Fee 
Determination Board regularly rated LB&B Associates' performance using 
a system described in its contract to calculate a composite performance 
score.[Footnote 33] According to the board, LB&B Associates' 
performance was outstanding--the highest level--for more than 2 years, 
until the rating period in which the strike began. The board faulted 
LB&B Associates in several rating categories resulting in a decline in 
its performance rating. For example, according to the board, LB&B 
Associates' strike contingency plan, which describes how essential 
operations would be continued in the event of a strike, was outdated. 
As a result, implementation of the plan was slowed because it took up 
to 48 hours before all of its temporary workers arrived on the island. 
Moreover, some subcontracts cost more than anticipated.

According to the board, LB&B Associates overcame initial problems in 
implementing its contingency plan and, overall, performed at the 
superior level. For example, temporary workers and subcontractors hired 
by LB&B Associates quickly repaired the water system that had been 
sabotaged on the first day of the strike. Furthermore, according to the 
board, some activities improved after the onset of the strike, 
including the maintenance of steam pipes, an important component of the 
process used to decontaminate laboratory waste contaminated with 
pathogens. Also, boat maintenance and cafeteria services--both of 
which, according to the Board, had been problematic before the strike-
-improved after replacement workers were hired. Figure 2 shows the 
composite scores the board gave LB&B Associates from fiscal year 2000 
through the first quarter of fiscal year 2003, which includes the time 
during which the strike occurred.

Figure 2: USDA Award Fee Determination Board's Composite Scores for 
LB&B Associates' Performance from October 1999 through January 2003:

[See PDF for image]

Note: GAO presentation of USDA data.

[A] USDA rated LB&B Associates quarterly through fiscal year 2000; USDA 
changed to a 6-month rating schedule beginning with fiscal year 2001.

[B] The strike began in August of this rating period, April 1, 2002, 
through January 5, 2003, which would have ended on September 30, 2002; 
however, because the contract was extended through January 2003, the 
rating period was extended also.

[End of figure]

More details about how the board evaluated LB&B Associates' performance 
are contained in table 1.

Table 1: Summary of the Award Fee Determination Board's Rating of LB&B 
Associates' Performance from April 2002 to January 2003.

Performance categories: Utilities; Types of activities: * Heating, A/C, 
and ventilation; * Refrigeration; * Plumbing and pipefitting; * Power 
plant operations; * Wastewater operations; * Electronics; Score and 
level of performance: 77 Superior.

Performance categories: Safety, health and environmental compliance; 
Types of activities: * Security; * Emergency health services; * 
Environmental compliance; * Biological safety; * Fire alarm support; 
Score and level of performance: 70 Satisfactory.

Performance categories: Program and cost management; Types of 
activities: * Contract and cost management; * Special task management; 
* Resource utilization; * Quality control; * Subcontract management; * 
Scheduling and coordination; * Communications and reporting; Score and 
level of performance: 80 Superior.

Performance categories: Facilities; Types of activities: * Painting and 
carpentry; * Equipment maintenance; * Janitorial functions; * General 
building and grounds maintenance; Score and level of performance: 76 
Superior.

Performance categories: Administrative support; Types of activities: * 
Photography services; * Mail; * Laundry; * Glassware; * Food services; 
Score and level of performance: 82 Superior.

Performance categories: Transportation; Types of activities: * All 
marine and vehicle transportation services; * Boat and vehicle 
maintenance; Score and level of performance: 71 Superior.

Source: GAO.

Note: GAO presentation of USDA data.

[End of table]

Employee Qualifications:

To maintain operations at Plum Island after the strike began, LB&B 
Associates brought in temporary replacements from some of its other 
contract sites, hired subcontractors, and subsequently hired permanent 
replacement workers, as described in the strike contingency plan. We 
confirmed that workers in certain positions, including boat operators 
and operators for the wastewater treatment system, were licensed as 
prescribed by LB&B Associates' contract with USDA. In addition, many of 
the replacement workers appear to have significant and relevant work 
experience for the positions for which they were hired.

Although LB&B Associates and USDA staff worked together to maintain 
vital functions, operations were affected at times by the strike 
because of the reduced workforce and the loss of some workers with 
specific skills and/or qualifications. For example, the ferries that 
take workers to and from the island operated on a reduced schedule 
until all three boat masters who had walked out were replaced by 
individuals with the necessary Coast Guard license. Also, some USDA 
officials stepped in to fulfill duties that were normally performed by 
qualified contract staff, such as monitoring the air filters in the 
laboratory, until qualified replacements were hired. By July 2003, most 
positions left vacant by the strike were filled, most of them by 
permanent replacement workers and 16 by striking workers who returned 
to work on the island.

Costs Attributable to the Strike:

With USDA's approval, LB&B Associates exceeded its estimated budget by 
about $511,000, or approximately 5 percent, during the 15-month period 
covering fiscal year 2002 and the first quarter of fiscal year 
2003,[Footnote 34] the period during which the strike began.[Footnote 
35] USDA allowed the additional expenditures, which occurred in the 
last 2 months of fiscal year 2002 and the first 3 months of 2003, 
because it recognized that the strike would result in higher expenses 
and it found LB&B Associates' estimate for exceeding the budget to be 
acceptable, under the circumstances. As required by Federal Acquisition 
Regulations, LB&B Associates notified USDA that it expected to exceed 
its budget as a result of the strike.[Footnote 36] Figure 3 shows the 
total costs LB&B Associates charged to USDA from October 1, 2001 
through January 5 2003; the graph also incorporates costs billed to 
USDA by North Fork Services from January 6 through May 31, 2003, 
illustrating the continued fluctuation in contract costs.

Figure 3: Monthly Costs Billed to USDA, October 2001 through May 2003:

[See PDF for image]

Note: GAO presentation of USDA data.

[End of figure]

According to LB&B Associates' data,[Footnote 37] there were 
fluctuations in Plum Island's costs, as shown in figure 3. Also, as a 
result of the strike, additional costs were incurred in the following 
areas from August 1, 2002, through January 5, 2003,[Footnote 38] unless 
otherwise noted: labor (salary and benefits), subcontracts, cafeteria, 
and travel (including lodging and transportation).

Labor: The cost of labor peaked at $428,161 in August 2002, a 16 
percent increase over the average monthly cost of $370,118 for the 
previous 10 months. Monthly labor costs then gradually decreased until 
November, when the cost of labor was about 1.6 percent more than the 
average monthly cost. Labor costs increased because most of the 
temporary replacements were management-level employees from other LB&B 
Associates contract sites, who earned more than the employees they 
replaced. According to its documents, LB&B Associates used management-
level employees because union members from other localities usually 
honor a picket line and would not temporarily replace union strikers. 
As new permanent employees were hired, the cost of labor gradually 
decreased.

Subcontracts: Subcontracts related to the strike, such as for providing 
security guards at the picket line, added about $523,000,[Footnote 39] 
or 77 percent of the total subcontract costs billed to USDA by LB&B 
Associates.

Cafeteria: Cafeteria expenses increased by about $12,000, or 51 percent 
of the total cafeteria expenses because the cafeteria provided two 
meals per day for the temporary replacements, who spent more time on 
the island to ensure continued operations than employees had before the 
strike began.

Travel: Travel expenses attributed to the strike, such as transporting 
and housing the temporary replacement workers, totaled more than 
$125,000, constituting 98 percent of the total travel costs billed to 
USDA during that time period.

[End of section]

Appendix IV: Comments from the Department of Homeland Security:

U.S. Department of Homeland Security:

August 19, 2003:

Mr. Lawrence J. Dyckman:

Director, Natural Resources and Environment U.S. General Accounting 
Office:

441 G Street, NW Washington, DC 20548:

Dear Mr. Dyckman:

Thank you for providing us with a copy of your draft report entitled 
Combating Terrorism: Actions Needed to Improve Security at Plum Island 
Animal Disease Center (GAO-03-847).

We agree with the General Accounting Office's overall observation that 
the security at Plum Island Animal Disease Center (PIADC) has improved, 
but still has fundamental problems that leave the facility vulnerable 
to security breaches. Since assuming administrative responsibility for 
PIADC operations on June l, 2003, the Department of Homeland Security 
has made significant strides toward addressing the recommendations 
contained in the body of the report.

If you have any questions concerning this response, please contact Marc 
S. Hollander, Acting Center Director, PIADC on 631-323-3207.

Sincerely,

Dr. Charles E. McQueary:

Under Secretary for Science and Technology:

Signed by Dr. Charles E. McQueary:

Department of Homeland Security Comments on GAO Draft Report:

General Comment:

While the Department of Homeland Security (DHS) accepts and supports 
the seven separate recommendations made as part of this report, we 
would like to note that significant progress had been made by the USDA 
prior to June l, 2003 when island operations was transferred to the 
DHS. Since assuming that responsibility, DHS has continued to identify 
and manage the existing improvements and complete an assessment 
baseline of the entire island posture followed by development of a 
detailed corrective action plan with implementing timelines.

Responses to Recommendations for Executive Action:

Recommendation #1:

Correct physical security deficiencies by (1) fully implementing the 
physical security measures, (2) addressing the specific security 
shortcomings identified by our Office of Special Investigations, (3) 
better securing the physical infrastructure that supports the continued 
operation of the Plum Island Animal Disease Center, and (4) better 
securing the foot-and-mouth disease vaccine bank.

Corrective Action:

DHS agrees, in principle, with the assumptions and assertions made in 
the report as modified by the suggested text to demonstrate the 
progress made since assuming administrative responsibility for the 
island on June 1, 2003. During the first 60-days since assuming 
administrative responsibility for the island, DHS conducted a detailed 
assessment and baseline of the current state of island operations and 
infrastructure. Results from that assessment have been briefed to 
senior leadership in the DHS as well as the USDA and the next steps are 
to develop a step-by-step corrective action report with timelines and 
actionable items.

Recommendation #2:

Limit access to pathogens by further developing and enforcing specific 
procedures to ensure (1) that all individuals involved in laboratory 
activities in the biocontainment area, including students, regardless 
of citizenship, have been approved, in accordance with the law, (2) 
that background checks of these individuals are regularly updated; and 
(3) that cleaning, maintenance and repair staff entering biocontainment 
are escorted at all times by individuals with completed background 
checks.

Corrective Actions:

DHS has undertaken a detailed study of all existing security-related 
policies and procedures; specifically those that relate to the 
restriction of access to the biocontainment areas at the Plum Island 
Animal Disease Center. The DHS plans to develop, in concert with the 
USDA as 
appropriate, a limited use policy to identify access control 
requirements for all personnel required to enter the biocontainment 
facility.

Recommendation #3:

Consult with other laboratories to identify ways to mitigate the 
inherent difficulty of securing pathogens.

Corrective Action:

DHS has been working closely with National Nuclear Security 
Administration National Laboratories to identify applicable security 
policies and procedures. Specifically, DHS has been working very 
closely with US Army Medical Research Institute of Infectious Diseases, 
the National Institutes of Health, and Health and Human Services in 
developing consistent and complete security policies and procedures to 
limit access to pathogens.

Recommendation #4:

Enhance incident response capability by (1) resolving the issue of the 
guards' authority to carry firearms and make arrests; (2) increasing 
the size of the guard force; (3) completing an agreement with local law 
enforcement agencies to ensure backup assistance when needed; (4) 
defining and adequate response time for law enforcement to respond to 
incidents; (5) developing an incident response plan that include 
precise detail about what to do in the event an incident occurs that 
exceeds the capability of the security system, such as a terrorist 
attack; and (6) conducting exercises with local law enforcement to test 
the efficiency and effectiveness of Plum Island's response capability.

Corrective Action:

DHS has been working closely with the FPS to develop a task for 
specific assistance to the island. FPS spent several weeks on the 
island integrated with the existing guard force to determine the scope 
and requirements for the developing task assignment. DHS expects to 
proceed with tasking the FPS to the island in the near future. That 
tasking will bring arrest and detention authority to the island.

Funds have been requested to increase the guard force beginning in FY 
2004 allowing for better coverage of the island. Adding these 
additional security professionals will also enable the island to enter 
into mutual aid agreements with local law enforcement professionals.

The DHS assessment also identified the lack of an incident response 
plan. The associated corrective action plan will identify in detail the 
path forward in developing this plan and integrating it with local law 
enforcement capabilities and requirements.

During the site visits with the local law enforcement as well as local 
firefighters, we began discussing mutual aid agreement requirements and 
joint exercise development and execution.

Expectation is that over the upcoming year DHS and the local community 
will be in a position to define the mutual aid requirement and develop 
a robust exercise plan and schedule.

Recommendation #5:

Reconsider the security risks at Plum Island, taking into account 
recent acts of disgruntled employees.

Corrective Action:

As part of the baseline assessment, the DHS has undertaken a review of 
the USDA threat statement with the guidance to review the entire 
security posture of the island again like facilities. This review will 
result in a revise threat statement more appropriately reflecting the 
existing and possible threats. The revised threat statement will be 
issued by early next year.

Recommendation #6:

Consult with appropriate state and local law enforcement and 
intelligence agencies to revisit the threats specific to the Plum 
Island Animal Disease Center.

Corrective Action:

Consistent with the above responses, the DHS will continue to work with 
the local and national law enforcement agencies in developing a 
complete set of possible threats for the island.

Recommendation #7:

Revise, as necessary, security and incident response plans to reflect 
any redefined risks, threats, and assets.

Corrective Action:

As part of the assessment baseline, the DHS has been reviewing existing 
policies, procedures, and incident response plans to ensure that they 
remain appropriate while the threat statement and mutual aid agreements 
are being developed and/or revised. DHS will continue to work with 
other research facilities in developing the islands' threat statement 
and the security posture required.

[End of section]

Appendix V: Comments from the U.S. Department of Agriculture:

USDA:

United States Department of Agriculture:

Research, Education, and Economics Agricultural Research Service:

August 29, 2003:

Mr. Lawrence J. Dyckman Director:

United States General Accounting Office Natural Resources and 
Environment Washington, D.C. 20548:

Dear Mr. Dyckman:

This letter is in response to your request for comments on your 
proposed report entitled Combating Bioterrorism: Actions Needed to 
Improve Security at Plum Island Animal Disease Center, (GAO-03-847). 
Enclosed please find comments from the Department of Agriculture (USDA) 
from both the Agricultural Research Service and the Animal and Plant 
Health Inspection Service.

These comments were shared with your team during a meeting in my office 
on August 20, 2003. USDA appreciated the opportunity to have that 
meeting to go over the report with you. This e-mail is provided to 
document and clarify our comments made at the time of that meeting.

Thank you for the opportunity to respond to the draft report.

Sincerely,

CAIRD E. REXROAD, JR. 
Acting Associate Administrator:

Signed by CAIRD E. REXROAD, JR.: 

Enclosure:

USDA Response to the Draft GAO report, Combating Bioterrorism: Actions 
Needed to Improve Security at Plum Island Animal Disease Center (GAO -
03-847).

General Comments:

USDA wishes to emphasize that security at Plum Island has been an 
ongoing concern and that a risk-assessment based approach was used post 
9-11 to define the measures that we subsequently put in place to 
protect our assets, specifically our pathogen holding. We believe that 
this report, to be useful, must make judgments about needs for enhanced 
security against a specific risk assessment based approach considering 
both probability and consequences of specific types of attacks. We 
acknowledge that security was not focused on a "terrorist attack" as 
little evidence or rationale suggest a significant probability of such 
an attack as a preferred way to gain access to pathogens.

Although the report suggests that security concerns at Plum Island 
Animal Disease Center were triggered by the events of September 11, 
2001, we would like to call to your attention that the original 
contract with the Army Corps of Engineers for security upgrades was 
issued in August 2000, and amended twice to expand the scope of the 
work in May 2001. USDA engaged Sandia National Laboratories (SNL) to 
provide guidance on facility security immediately after September 11, 
2001. Sandia's experience with other Government and university labs 
aided USDA in framing its security approach. A security specialist was 
hired at PIADC in June 2002 in response to the SNL assessment. A 
contract for major security upgrades was issued in June 2002 with 
completion scheduled for December 2003.

The draft report suggested in multiple places that the threat to PIADC 
and probability of the theft of pathogens increased markedly with the 
advent of the strike by LB&B employees who had been involved in the 
maintenance operations of the facility. Furthermore, the report 
suggests that USDA failed to take proper steps to reevaluate or 
mitigate the increased threat. The threat of a disgruntled insider was 
one of the three primary risks identified by the original SNL security 
assessment made in October 2001. USDA took several steps to enhance 
security in response to the strike. The guard force on the island and 
at Orient Point was increased. The guards on the island were armed. The 
strikers were excluded from the island and from the parking and boat 
access at Point Orient.

The draft report indicates that under USDA, the security guards did not 
have the authority to carry firearms and make arrests. USDA believes 
that we appropriately used armed guards at PIADC. Furthermore, GAO 
stresses the importance of working with local law enforcement. Although 
verbal agreements were made between State and local law enforcement and 
ARS for cooperation at PIADC, a formal signed agreement underwent a 
series of legal reviews and was never finalized because of the arrest 
and detention authority issue. Nonetheless, there were communications 
between PIADC and local law enforcement. During the strike or during 
heightened alert they were provided regular briefings.

The draft report questions the "escorting" of persons who lack 
appropriate background investigations into the restricted area 
containing pathogens. USDA maintains, and SNL concurs, that the 
practice of persons with appropriate background investigations 
providing continuous escort of persons who do not, is widely accepted 
as an appropriate practice. This policy has been well documented at 
PIADC. We acknowledge problems with implementation of this policy that 
GAO brought to our attention and believe that the current escort 
practices are reliable.

You provided specific information during our meeting that certain 
background investigations should be renewed. We appreciate receiving 
the list and have evaluated it. We found that 5 of 11 contractor/
employees had not expired, 3 had already been sent to Office of 
Personnel Management for renewal, and 3 had expired but no action had 
been taken for renewal. A system has been established to alert 
management 6 months prior to expiration of a background investigation.	
Background investigations for all eight of the non-citizens on your 
list are already in process.

[End of section]

Appendix VI: GAO Contact and Staff Acknowledgments:

GAO Contact:

Charles M. Adams, (202) 512-8010:

Acknowledgments:

In addition to the individual named above, Aldo Benejam, Nancy 
Crothers, Mary Denigan-Macauley, Jonathan Gill, Thomas Farrell, Wyatt 
R. Hundrup, and Ramon Rodriguez made key contributions to this report.

(360295):

FOOTNOTES

[1] The Homeland Security Act of 2002 (P.L. 107-296,  310) authorized 
the transfer of Plum Island to DHS.

[2] U.S. General Accounting Office, Homeland Security: A Risk 
Management Approach Can Guide Preparedness Efforts, GAO-02-208T 
(Washington, D.C.: Oct. 31, 2001).

[3] An outbreak directly impacts the trade sector because countries 
constrain trade with those markets whose products may be tainted with 
foot-and-mouth disease. Other sectors, such as tourism are affected 
because tourist activities are restricted, especially in quarantined 
areas. Production from infected or quarantined herds is zero because 
production is stopped when animals are slaughtered and products from 
infected animals are not permitted into the food chain.

[4] Laboratories adhere to specific biosafety guidelines according to 
their designated biosafety level, which can range from 1 to 4. 
Biosafety level 1 is acceptable for low-risk organisms that may be 
found, for example, in high school laboratories. Biosafety level 4 is 
reserved for a number of exotic and highly lethal pathogens, such as 
ebola. There are only five facilities in the United States with 
biosafety level 4 laboratories, including the Department of the 
Defense's U.S. Army Medical Research Institute of Infectious Diseases 
and the Department of Health and Human Services' National Institutes of 
Health. Plum Island operates a biosafety level 3 agriculture 
laboratory with some additional special agricultural safety features to 
prevent the release of animal disease pathogens into the environment.

[5] Pub. L. No. 107-56,  817.

[6] Pub. L. No. 107-188,  211-213.

[7] 7 CFR part 331.

[8] USDA Security Policies and Procedures for Biosafety Level-3 
Facilities, Agricultural Research Service, DM 9610-1.

[9] Also, USDA had engaged the U.S. Army Corps of Engineers in August 
2000 to make some physical security improvements at Plum Island, but 
this work was not based on an assessment of threats and risks. Few of 
the measures suggested by the Corps were implemented. In addition, 
Sandia officials told us that they did not agree with the approach 
taken by the Corps and that their physical security recommendations 
differed significantly. USDA has relied on Sandia's security 
recommendations.

[10] Foot-and-mouth disease cannot be studied on the mainland of the 
United States unless the Secretary of Agriculture determines that it is 
necessary to do so (see 21 U.S.C.  113a).

[11] USDA officials told us that they considered these scientists to be 
"grandfathered"--that is, USDA did not require background checks to 
gain unescorted access because these scientists were employed before 
enactment of the Bioterrorism Preparedness Act in June 2002. In 
addition, we found that three of these scientists arrived after this 
date--December 2002 and February and May 2003.

[12] USDA Security Policies and Procedures for Biosafety Level 3-
Facilities, Agricultural Research Service, DM 9610-1.

[13] 7 CFR  331.10 and 331.11.

[14] 7 CFR  331.10(a)(2)(iv)(B).

[15] Out of concern that Iraqi scientists were trying to manipulate 
camel pox for possible warfare use, USDA conducted work for the 
Department of Defense to determine if camel pox could be manipulated 
into an agent similar to smallpox. 

[16] USDA's Office of General Counsel was aware of this issue for over 
1 year but had not resolved it as of June 2003 when DHS became 
responsible for Plum Island.

[17] A draft policy on the use of force was written for the guard force 
on Plum Island but never put into use.

[18] The Federal Protective Service's goal is to provide a safe 
environment in which federal agencies can conduct their business by 
reducing threats posed against federal facilities, which range from 
terrorism to workplace violence to larcenies.

[19] Under the Homeland Security Act of 2002, DHS has authority for its 
officers to carry firearms and make arrests.

[20] Additional observations of our Office of Special Investigations 
are included in appendix II.

[21] Southold town police are located on Long Island in Suffolk County, 
approximately 5 miles from Plum Island.

[22] In a life-and-death situation, the Suffolk County Police 
Department could respond with a helicopter, significantly reducing 
response time.

[23] See 7 CFR,  331.11 (a) (3).

[24] Officials of the FBI's New York office and of the Suffolk County's 
Police Department and Department of Fire, Rescue and Emergency Service 
told us that they would welcome the opportunity to review Plum Island's 
security assessment and response plans and would assist with this 
coordination.

[25] Water pressure is a vital component of the process used to 
decontaminate materials in the biocontainment area in order to prevent 
the spread of animal diseases. Convicted of malicious mischief for 
tampering with the water system, the employee was sentenced to 5 years' 
probation and ordered to pay restitution.

[26] USDA officials said that although it was never proven that 
replacement workers were to blame for the outage, this illustrates the 
discontent on the island. Information on the qualifications of 
replacement workers can be found in appendix III.

[27] While intelligence officials did not contribute to the assessment 
of threats to Plum Island, USDA has established links that provide 
current information about terrorist threats.

[28] Pub. L. No. 107-56.

[29] Pub. L. No. 107-188   211-213.

[30] 7 CFR  331.

[31] Office of Management and Budget, OMB Circular A-123 Management 
Accountability and Control (Washington, D.C.: 1995). This document 
provides the specific requirements for assessing and reporting on 
controls within the executive branch. 

[32] U.S. General Accounting Office, Internal Control: Standards for 
Internal Control in the Federal Government, GAO/AIMD-00-21.3.1 
(Washington, D.C.: November 1999). The Federal Managers' Financial 
Integrity Act of 1982 (FMFIA) requires us to issue standards for 
internal control in government. Among other things, the standards 
provide the overall framework for establishing and maintaining internal 
control. 

[33] The Award Fee Determination Board consisted of six officials who 
worked on Plum Island: center director, assistant center director, 
administrative contract officer, safety officer, APHIS laboratory 
chief, and ARS foot-and-mouth disease unit scientist. The composite 
score could have placed LB&B at one of five levels: 0-34, unacceptable; 
35-49, unsatisfactory; 50-70, satisfactory; 71-84, superior; and 85-
100, outstanding.

[34] LB&B Associates exceeded its fiscal year 2002 estimated budget of 
$8,027,011 by approximately $151,000, or about 1.9 percent. In the 
first quarter of fiscal year 2003, which covered October 1, 2002, 
through January 5, 2003, the contractor exceeded the estimated budget 
of $2,250,524 by about $360,000, or about 16 percent.

[35] Prior to the strike, LB&B Associates billed to USDA over $107,000 
in legal fees associated with renewing the collective bargaining 
agreement through May 31, 2002, after which time LB&B Associates itself 
paid about $136,000 in legal fees through April 2003.

[36] Under a cost-reimbursable contract, Federal Acquisition 
Regulations require that the contractor notify the agency in writing 
whenever it has reason to believe that its costs will exceed 75 percent 
of the estimated budget, or if the total cost will be greater or 
significantly less than the estimated budget. Also, as part of the 
notification process, the contractor is required to provide the agency 
with a revised estimate of the total cost of performing its contract. 
In this case, if USDA had not accepted the cost increases, USDA 
officials said that USDA and LB&B Associates officials would have had 
to agree on which services to discontinue in order to stay on budget.

[37] An independent auditor found that LB&B Associates' statements of 
income, changes in equity, and cash flows fairly represent the 
financial position of the company for the fiscal year ending September 
30, 2002.

[38] Costs rose sharply in December 2002 because costs related to 
subcontracts that were incurred in October and November were not billed 
to USDA until December, due to the billing cycles of LB&B Associates 
and the subcontractors. These subcontract-related costs were for tasks 
unrelated to the strike, such as security guards on the island, and 
related to the strike, such as security guards at the picket line.

[39] North Fork Services incurred an additional $36,000 in subcontract 
costs related to the strike from January 6 through May 31, 2003. These 
subcontracts were for delivering supplies and materials to Orient Point 
and for security at the picket line on Orient Point while striking 
workers were picketing.

GAO's Mission:

The General Accounting Office, the investigative arm of Congress, 
exists to support Congress in meeting its constitutional 
responsibilities and to help improve the performance and accountability 
of the federal government for the American people. GAO examines the use 
of public funds; evaluates federal programs and policies; and provides 
analyses, recommendations, and other assistance to help Congress make 
informed oversight, policy, and funding decisions. GAO's commitment to 
good government is reflected in its core values of accountability, 
integrity, and reliability.

Obtaining Copies of GAO Reports and Testimony:

The fastest and easiest way to obtain copies of GAO documents at no 
cost is through the Internet. GAO's Web site ( www.gao.gov ) contains 
abstracts and full-text files of current reports and testimony and an 
expanding archive of older products. The Web site features a search 
engine to help you locate documents using key words and phrases. You 
can print these documents in their entirety, including charts and other 
graphics.

Each day, GAO issues a list of newly released reports, testimony, and 
correspondence. GAO posts this list, known as "Today's Reports," on its 
Web site daily. The list contains links to the full-text document 
files. To have GAO e-mail this list to you every afternoon, go to 
www.gao.gov and select "Subscribe to e-mail alerts" under the "Order 
GAO Products" heading.

Order by Mail or Phone:

The first copy of each printed report is free. Additional copies are $2 
each. A check or money order should be made out to the Superintendent 
of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or 
more copies mailed to a single address are discounted 25 percent. 
Orders should be sent to:

U.S. General Accounting Office

441 G Street NW,

Room LM Washington,

D.C. 20548:

To order by Phone: 	

	Voice: (202) 512-6000:

	TDD: (202) 512-2537:

	Fax: (202) 512-6061:

To Report Fraud, Waste, and Abuse in Federal Programs:

Contact:

Web site: www.gao.gov/fraudnet/fraudnet.htm E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470:

Public Affairs:

Jeff Nelligan, managing director, NelliganJ@gao.gov (202) 512-4800 U.S.

General Accounting Office, 441 G Street NW, Room 7149 Washington, D.C.

20548: