You are given two reports by the government agency.  

Report 1:
The issue of executive discretion has been at the center of constitutional debates in liberal democracies throughout the twentieth century. How to balance a commitment to the rule of law with the exigencies of modern political and economic crises has engaged legislators and scholars in the United States and around the world. The United States Constitution is silent on questions of emergency power. As such, over the past two centuries, Congress and the President have answered those questions in varied and often ad hoc ways. In the eighteenth and nineteenth centuries, the answer was often for the President to act without congressional approval in a time of crisis, knowingly risking impeachment and personal civil liability. Congress claimed primacy over emergency action and would decide subsequently to either ratify the President's actions or indemnify the President for any civil liability. By the twentieth century, a new pattern had begun to emerge. Instead of retroactively judging an executive's extraordinary actions in a time of emergency, Congress created statutory bases permitting the President to declare a state of emergency and make use of extraordinary delegated powers. The expanding delegation of emergency powers to the executive and the increase of governing via emergency power by the executive has been a common trajectory among twentieth-century liberal democracies. As innovation has quickened the pace of social change and global crises, some legislatures have felt compelled to delegate to the executive, who traditional political theorists assumed could operate with greater "dispatch" than deliberate, future-oriented legislatures. Whether such actions subvert the rule of law or are a standard feature of healthy modern constitutional orders has been a subject of extensive debate. The International Emergency Economic Powers Act (IEEPA) is one such example of a twentieth-century delegation of emergency authority. One of 123 emergency statutes under the umbrella of the National Emergencies Act (NEA), IEEPA grants the President extensive power to regulate a variety of economic transactions during a state of emergency. Congress enacted IEEPA in 1977 to rein in the expansive emergency economic powers that it had been delegated to the President under the Trading with the Enemy Act (TWEA). Nevertheless, some scholars argue that judicial and legislative actions subsequent to IEEPA's enactment have made it, like TWEA, a source of expansive and unchecked executive authority in the economic realm. Others, however, argue that Presidents often use IEEPA to implement the will of Congress either as directed by law or as encouraged by congressional activity. Until recently, there has been little congressional discussion of modifying either IEEPA or its umbrella statute, the NEA. Recent presidential actions, however, have drawn attention to presidential emergency powers under the NEA of which IEEPA is the most frequently used. Should Congress consider changing IEEPA, there are two issues that Congress may wish to address. The first pertains to how Congress has delegated its authority under IEEPA and its umbrella statute, the NEA. The second pertains to choices made in the Export Control Reform Act of 2018. The First World War (1914-1918) saw an unprecedented degree of economic mobilization. The executive departments of European governments began to regulate their economies with or without the support of their legislatures. The United States, in contrast, was in a privileged position relative to its allies in Europe. Separated by an ocean from Germany and Austria-Hungary, the United States was never under substantial threat of invasion. Rather than relying on the inherent powers of the presidency, or acting unconstitutionally and waiting for congressional ratification, President Wilson sought explicit pre-authorization for expansive new powers to meet the global crisis. Between 1916 and the end of 1917, Congress passed 22 statutes empowering the President to take control of private property for public use during the war. These statutes gave the President broad authority to control railroads, shipyards, cars, telegraph and telephone systems, water systems, and many other sectors of the American economy. TWEA was one of those 22 statutes. It granted to the executive an extraordinary degree of control over international trade, investment, migration, and communications between the United States and its enemies. TWEA defined "enemy" broadly and included "any individual, partnership, or other body of individuals [including corporations], of any nationality, resident within the territory ... of any nation with which the United States is at war, or resident outside of the United States and doing business within such a territory ...." The first four sections of the act granted the President extensive powers to limit trading or communication with, or transporting enemies (or their allies) of the United States. These sections also empowered the President to censor foreign communications and place extensive restrictions on enemy insurance or reinsurance companies. It was Section 5(b) of TWEA, however, that would form one of the central bases of presidential emergency economic power in the twentieth century. Section 5(b), as originally enacted, states: That the President may investigate, regulate, or prohibit, under such rules and regulations as he may prescribe, by means of licenses or otherwise, any transactions in foreign exchange, export or earmarkings of gold or silver coin or bullion or currency, transfers of credit in any form (other than credits relating solely to transactions to be executed wholly within the United States), and transfers of evidences of indebtedness or of the ownership of property between the United States and any foreign country, whether enemy, ally of enemy or otherwise, or between residents of one or more foreign countries, by any person within the United States; and he may require any such person engaged in any such transaction to furnish, under oath, complete information relative thereto, including the production of any books of account, contracts, letters or other papers, in connection therewith in the custody or control of such person, either before or after such transaction is completed. The statute gave the President exceptional control over private international economic transactions in times of war. While Congress terminated many of the war powers in 1921, TWEA was specifically exempted because the U.S. Government had yet to dispose of a large amount of alien property in its custody. The Great Depression, a massive global economic downturn that began in 1929, presented a challenge to liberal democracies in Europe and the Americas. To deal with the complexities presented by the crisis, nearly all such democracies began delegating discretionary authority to their executives to a degree that had only previously been done in times of war. The U.S. Congress responded, in part, by dramatically expanding the scope of TWEA, delegating to the President the power to declare states of emergency in peacetime and assume expansive domestic economic powers. Such a delegation was made possible by analogizing economic crises to war. In public speeches about the crisis, President Franklin D. Roosevelt asserted that the Depression was to be "attacked," "fought against," "mobilized for," and "combatted" by "great arm[ies] of people." The economic mobilization of the First World War had blurred the lines between the executive's military and economic powers. As the Depression was likened to "armed strife" and declared to be "an emergency more serious than war" by a Justice of the Supreme Court, it became routine to use emergency economic legislation enacted in wartime as the basis for extraordinary economic authority in peacetime. As the Depression entered its third year, the newly-elected President Roosevelt sought from Congress "broad Executive power to wage a war against the emergency, as great as the power that would be given to me if we were in fact invaded by a foreign foe." In his first act as President, Roosevelt proclaimed a bank holiday, suspending all transactions at all banking institutions located in the United States and its territories for four days. In his proclamation, Roosevelt claimed to have authority to declare the holiday under Section 5(b) of TWEA. However, because the United States was not in a state of war and the suspended transactions were primarily domestic, the President's authority to issue such an order was dubious. Despite the tenuous legality, Congress ratified Roosevelt's actions by passing the Emergency Banking Relief Act three days after his proclamation. The act amended Section 5(b) of TWEA to read: During time of war or during any other period of national emergency declared by the President , the President may, through any agency that he may designate, or otherwise, investigate, regulate, or prohibit.... This amendment gave the President the authority to declare that a national emergency existed and assume extensive controls over the national economy previously only available in times of war. By 1934, Roosevelt had used these extensive new powers to regulate "Every transaction in foreign exchange, transfer of credit between any banking institution within the United States and any banking institution outside of the United States." With America's entry into the Second World War in 1941, Congress again amended TWEA to grant the President extensive powers over the disposition of private property, adding the so-called "vesting" power, which authorized the permanent seizure of property. Now in its most expansive form, TWEA authorized the President to declare a national emergency and, in so doing, to regulate foreign exchange, domestic banking, possession of precious metals, and property in which any foreign country or foreign national had an interest. The Second World War ended in 1945. Following the conflict, the allied powers constructed institutions and signed agreements designed to keep the peace and to liberalize world trade. However, the United States did not immediately resume a peacetime posture with respect to emergency powers. Instead, the onset of the Cold War rationalized the continued use of TWEA and other emergency powers outside the context of a declared war. Over the next several decades, Presidents declared four national emergencies under Section 5(b) of TWEA and assumed expansive authority over economic transactions in the postwar period. During the Cold War, economic sanctions became an increasingly popular foreign policy and national security tool, and TWEA was a prominent source of presidential authority to use the tool. In 1950, President Harry S. Truman declared a national emergency, citing TWEA, to impose economic sanctions on North Korea and China. Subsequent Presidents referenced that national emergency as authority for imposing sanctions on Vietnam, Cuba, and Cambodia. Truman likewise used Section 5(b) of TWEA to maintain regulations on foreign exchange, transfers of credit, and the export of coin and currency that had been in place since the early 1930s. Presidents Richard M. Nixon and Gerald R. Ford invoked TWEA to continue export controls established under the Export Administration Act when the act expired. TWEA was also a prominent instrument of postwar presidential monetary policy. Presidents Dwight D. Eisenhower and John F. Kennedy used TWEA and the national emergency declared by President Roosevelt in 1933 to maintain and modify regulations controlling the hoarding and export of gold. In 1968, President Lyndon B. Johnson explicitly used Truman's 1950 declaration of emergency under Section 5(b) of TWEA to limit direct foreign investment by U.S. companies in an effort to strengthen the balance of payments position of the United States after the devaluation of the pound sterling by the United Kingdom. In 1971, after President Nixon ended the convertibility of the U.S. dollar to gold, effectively ending the postwar monetary order, he made use of Section 5(b) of TWEA to declare a state of emergency and place a 10% ad valorem supplemental duty on all dutiable goods entering the United States. The reliance by the executive on the powers granted by Section 5(b) of TWEA meant that postwar sanctions regimes and significant parts of U.S. international monetary policy relied on continued states of emergency for their operation. By the mid-1970s, in the wake of U.S. military involvement in Vietnam, revelations of domestic spying, assassinations of foreign political leaders, the Watergate break-in, and other related abuses of power, Congress increasingly focused on checking the executive branch. The Senate formed a bipartisan special committee chaired by Senators Frank Church and Charles Mathias to reevaluate the expansive delegations of emergency authority to the President. The special committee issued a report surveying the President's emergency powers in which it asserted that the United States had technically "been in a state of national emergency since March 9, 1933" and that there were four distinct declarations of national emergency in effect. The report also noted that the United States had "on the books at least 470 significant emergency statutes without time limitations delegating to the Executive extensive discretionary powers, ordinarily exercised by the Legislature, which affect the lives of American citizens in a host of all-encompassing ways." In the course of its investigations, Senator Mathias, committee co-chair, noted, "A majority of the people of the United States have lived all of their lives under emergency government." Senator Church, the other co-chair, said the central question before the committee was "whether it [was] possible for a democratic government such as ours to exist under its present Constitution and system of three separate branches equal in power under a continued state of emergency." Among the more controversial statutes highlighted by the committee was TWEA. In 1977, during the House markup of a bill revising TWEA, Representative Jonathan Bingham, Chairperson of the House International Relations Committee's Subcommittee on Economic Policy, described TWEA as conferring "on the President what could have been dictatorial powers that he could have used without any restraint by Congress." According to the Department of Justice, TWEA granted the President four major groups of powers in a time of war or other national emergency: (a) Regulatory powers with respect to foreign exchange, banking transfers, coin, bullion, currency, and securities; (b) Regulatory powers with respect to "any property in which any foreign country or a national thereof has any interest"; (c) The power to vest "any property or interest of any foreign country or national thereof"; and (d) The powers to hold, use, administer, liquidate, sell, or otherwise deal with "such interest or property" in the interest of and for the benefit of the United States. The House report on the reform legislation called TWEA "essentially an unlimited grant of authority for the President to exercise, at his discretion, broad powers in both the domestic and international economic arena, without congressional review." The criticisms of TWEA centered on the following: (a) It required no consultation or reports to Congress with regard to the use of powers or the declaration of a national emergency. (b) It set no time limits on a state of emergency, no mechanism for congressional review, and no way for Congress to terminate it. (c) It stated no limits on the scope of TWEA's economic powers and the circumstances under which such authority could be used. (d) The actions taken under the authority of TWEA were rarely related to the circumstances in which the national emergency was declared. In testimony before the House Committee on International Relations, Professor Harold G. Maier summed up the development and the main criticisms of TWEA: Section 5(b)'s effect is no longer confined to "emergency situations" in the sense of existing imminent danger. The continuing retroactive approval, either explicit or implicit, by Congress of broad executive interpretations of the scope of powers which it confers has converted the section into a general grant of legislative authority to the President…" Congress's reforms to emergency powers under TWEA came in two acts. First, Congress enacted the National Emergencies Act (NEA) in 1976. The NEA provided for the termination of all existing emergencies in 1978, except those making use of Section 5(b) of TWEA, and placed new restrictions on the manner of declaring and the duration of new states of emergency, including: Requiring the President to immediately transmit to Congress of the declaration of national emergency. Requiring a biannual review whereby "each House of Congress shall meet to consider a vote on a concurrent [now joint, see below] resolution to determine whether that emergency shall be terminated." Authorizing Congress to terminate the national emergency through a privileged concurrent [now joint] resolution. Second, Congress tackled the thornier question of TWEA. Because the authorities granted by TWEA were heavily entwined with postwar international monetary policy and the use of sanctions in U.S. foreign policy, unwinding it was a difficult undertaking. The exclusion of Section 5(b) reflected congressional interest in preserving existing regulations regarding foreign assets, foreign funds, and exports of strategic goods. Similarly, establishing a means to continue existing uses of TWEA reflected congressional interest in "improving future use rather than remedying past abuses." The subcommittee charged with reforming TWEA spent more than a year preparing reports, including the first complete legislative history of TWEA, a tome that ran nearly 700 pages. In the resulting legislation, Congress did three things. First, Congress amended TWEA so that it was, as originally intended, only applicable "during a time of war." Second, Congress expanded the Export Administration Act to include powers that previously were authorized by reference to Section 5(b) of TWEA. Finally, Congress wrote the International Emergency Economic Powers Act (IEEPA) to confer "upon the President a new set of authorities for use in time of national emergency which are both more limited in scope than those of section 5(b) and subject to procedural limitations, including those of the [NEA]." The Report of the House Committee on International Relations summed up the nature of an "emergency" in their "new approach" to international emergency economic powers: [G]iven the breadth of the authorities, and their availability at the President's discretion upon a declaration of a national emergency, their exercise should be subject to various substantive restrictions. The main one stems from a recognition that emergencies are by their nature rare and brief, and are not to be equated with normal ongoing problems. A national emergency should be declared and emergency authorities employed only with respect to a specific set of circumstances which constitute a real emergency, and for no other purpose. The emergency should be terminated in a timely manner when the factual state of emergency is over and not continued in effect for use in other circumstances. A state of national emergency should not be a normal state of affairs. IEEPA, as currently amended, empowers the president to: (A) investigate, regulate, or prohibit: (i) any transactions in foreign exchange, (ii) transfers of credit or payments between, by, through, or to any banking institution, to the extent that such transfers or payments involve any interest of any foreign country or national thereof, (iii) the importing or exporting of currencies or securities; and (B) investigate, block during the pendency of an investigation, regulate, direct and compel, nullify, void, prevent or prohibit, any acquisition, holding, withholding, use, transfer, withdrawal, transportation, importation or exportation of, or dealing in, or exercising any right, power, or privilege with respect to, or transactions involving, any property in which any foreign country or a national thereof has any interest by any person, or with respect to any property, subject to the jurisdiction of the United States. (C) when the United States is engaged in armed hostilities or has been attacked by a foreign country or foreign nationals, confiscate any property, subject to the jurisdiction of the United States, of any foreign person, foreign organization, or foreign country that he determines has planned, authorized, aided, or engaged in such hostilities or attacks against the United States; and all right, title, and interest in any property so confiscated shall vest, when, as, and upon the terms directed by the President, in such agency or person as the President may designate from time to time, and upon such terms and conditions as the President may prescribe, such interest or property shall be held, used, administered, liquidated, sold, or otherwise dealt with in the interest of and for the benefit of the United States, and such designated agency or person may perform any and all acts incident to the accomplishment or furtherance of these purposes. These powers may be exercised "to deal with any unusual and extraordinary threat, which has its source in whole or substantial part outside the United States, to the national security, foreign policy, or economy of the United States, if the President declares a national emergency with respect to such threat." Presidents may invoke IEEPA under the procedures set forth in the NEA. When declaring a national emergency, the NEA requires that the President "immediately" transmit the proclamation declaring the emergency to Congress and publish it in the Federal Register . The President must also specify the provisions of law that he or she intends to use. In addition to the requirements of the NEA, IEEPA provides several further restrictions. Preliminarily, IEEPA requires that the President consult with Congress "in every possible instance" before exercising any of the authorities granted under IEEPA. Once the President declares a national emergency invoking IEEPA, he or she must immediately transmit a report to Congress specifying: (1) the circumstances which necessitate such exercise of authority; (2) why the President believes those circumstances constitute an unusual and extraordinary threat, which has its source in whole or substantial part outside the United States, to the national security, foreign policy, or economy of the United States; (3) the authorities to be exercised and the actions to be taken in the exercise of those authorities to deal with those circumstances; (4) why the President believes such actions are necessary to deal with those circumstances; and (5) any foreign countries with respect to which such actions are to be taken and why such actions are to be taken with respect to those countries. The President subsequently is to report on the actions taken under the IEEPA at least once in every succeeding six-month interval that the authorities are exercised. As per the NEA, the emergency may be terminated by the President, by a privileged joint resolution of Congress, or automatically if the President does not publish in the Federal Register and transmit to Congress a notice stating that such emergency is to continue in effect after such anniversary. Congress has amended IEEPA eight times ( Table 1 ). Five of the eight amendments have altered civil and criminal penalties for violations of orders issued under the statute. Other amendments excluded certain informational materials and expanded IEEPA's scope following the terrorist attacks of September 11, 2001. Congress also amended the NEA in response to a ruling by the Supreme Court to require a joint rather than a concurrent resolution to terminate a national emergency. As originally enacted, IEEPA protected the rights of U.S. persons to participate in the exchange of "any postal, telegraphic, telephonic, or other personal communication, which does not involve a transfer of anything of value" with a foreign person otherwise subject to sanctions. Amendments in 1988 and 1994 updated this list of protected rights to include the exchange of published information in a variety of formats. The act currently protects the exchange of "information or informational materials, including but not limited to, publications, films, posters, phonograph records, photographs, microfilms, microfiche, tapes, compact disks, CD ROMs, artworks, and news wire feeds," provided such exchange is not otherwise controlled for national security or foreign policy reasons related to weapons proliferation or international terrorism. Unlike the Trading with the Enemy Act (TWEA), IEEPA did not allow the President to vest assets as originally acted. In 2001, at the request of George W. Bush Administration, Congress amended IEEPA as part of the USA PATRIOT Act to return to the President the authority to vest frozen assets, but only under certain circumstances: ... the President may ... when the United States is engaged in armed hostilities or has been attacked by a foreign country or foreign nationals, confiscate any property, subject to the jurisdiction of the United States, of any foreign person, foreign organization, or foreign country that [the President] determines has planned, authorized, aided, or engaged in such hostilities or attacks against the United States; and all right, title, and interest in any property so confiscated shall vest, when, as, and upon the terms directed by the President, in such agency or person as the President may designate from time to time, and upon such terms and conditions as the President may prescribe, such interest or property shall be held, used, administered, liquidated, sold, or otherwise dealt with in the interest of and for the benefit of the United States, and such designated agency or person may perform any and all acts incident to the accomplishment or furtherance of these purposes. Speaking about the efforts of intelligence and law enforcement agencies to identify and disrupt the flow of terrorist finances, Attorney General John Ashcroft told Congress: At present the President's powers are limited to freezing assets and blocking transactions with terrorist organizations. We need the capacity for more than a freeze. We must be able to seize. Doing business with terrorist organization must be a losing proposition. Terrorist financiers must pay a price for their support of terrorism, which kills innocent Americans. Consistent with the President's [issuance of E.O. 13224 ] and his statements [of September 24, 2001], our proposal gives law enforcement the ability to seize the terrorists' assets. Further, criminal liability is imposed on those who knowingly engage in financial transactions, money-laundering involving the proceeds of terrorist acts. The House Judiciary Committee report explaining the amendments described its purpose as follows: Section 203 of the International Emergency Economic Powers Act (50 U.S.C. § 1702) grants to the President the power to exercise certain authorities relating to commerce with foreign nations upon his determination that there exists an unusual and extraordinary threat to the United States. Under this authority, the President may, among other things, freeze certain foreign assets within the jurisdiction of the United States. A separate law, the Trading With the Enemy Act, authorizes the President to take title to enemy assets when Congress has declared war. Section 159 of this bill amends section 203 of the International Emergency Economic Powers Act to provide the President with authority similar to what he currently has under the Trading With the Enemy Act in circumstances where there has been an armed attack on the United States, or where Congress has enacted a law authorizing the President to use armed force against a foreign country, foreign organization, or foreign national. The proceeds of any foreign assets to which the President takes title under this authority must be placed in a segregated account can only be used in accordance with a statute authorizing the expenditure of such proceeds. Section 159 also makes a number of clarifying and technical changes to section 203 of the International Emergency Economic Powers Act, most of which will not change the way that provision currently is implemented. The government has apparently never employed the vesting power to seize Al Qaeda assets within the United States. Instead, the government has sought to confiscate them through forfeiture procedures. The first, and to date, apparently only, use of this power under IEEPA occurred on March 20, 2003. On that date, in Executive Order 13290, President George W. Bush ordered the blocked "property of the Government of Iraq and its agencies, instrumentalities, or controlled entities" to be vested "in the Department of the Treasury.... [to] be used to assist the Iraqi people and to assist in the reconstruction of Iraq." However, the President's order excluded from confiscation Iraq's diplomatic and consular property, as well as assets that had, prior to March 20, 2003, been ordered attached in satisfaction of judgments against Iraq rendered pursuant to the terrorist suit provision of the Foreign Sovereign Immunities Act and § 201 of the Terrorism Risk Insurance Act (which reportedly totaled about $300 million) . A subsequent executive order blocked the property of former Iraqi officials and their families, vesting title of such blocked funds in the Department of the Treasury for transfer to the Development Fund for Iraq (DFI) to be "used to meet the humanitarian needs of the Iraqi people, for the economic reconstruction and repair of Iraq's infrastructure, for the continued disarmament of Iraq, for the cost of Iraqi civilian administration, and for other purposes benefitting of the Iraqi people." The DFI was established by UN Security Council Resolution 1483, which required member states to freeze all assets of the former Iraqi government and of Saddam Hussein, senior officials of his regime and their family members, and transfer such assets to the DFI, which was then administered by the United States. Most of the vested assets were used by the Coalition Provision Authority (CPA) for reconstruction projects and ministry operations. The USA PATRIOT Act made three other amendments to Section 203 of IEEPA. After the power to investigate, it added the power to block assets during the pendency of an investigation. It clarified that the type of interest in property subject to IEEPA is an "interest by any person, or with respect to any property, subject to the jurisdiction of the United States." It also added subsection (c), which provides: In any judicial review of a determination made under this section, if the determination was based on classified information (as defined in section 1(a) of the Classified Information Procedures Act) such information may be submitted to the reviewing court ex parte and in camera. This subsection does not confer or imply any right to judicial review. As described in the House Judiciary Committee report, these provisions were meant to clarify and codify existing practices. Like TWEA prior to its amendment in 1977, the President and Congress together have often turned to IEEPA to impose economic sanctions in furtherance of U.S. foreign policy and national security objectives. While initially enacted to rein in presidential emergency authority, presidential emergency use of IEEPA has expanded in scale, scope, and frequency since the statute's enactment. The House report on IEEPA stated, "emergencies are by their nature rare and brief, and are not to be equated with normal, ongoing problems." National emergencies invoking IEEPA, however, have increased in frequency and length since its enactment. Since 1977, Presidents have invoked IEEPA in 54 declarations of national emergency. On average, these emergencies last nearly a decade. Most emergencies have been geographically specific, targeting a specific country or government. However, since 1990, Presidents have declared non-geographically-specific emergencies in response to issues like weapons proliferation, global terrorism, and malicious cyber-enabled activities. The erosion of geographic limitations has been accompanied by an expansion in the nature of the targets of sanctions issued under IEEPA authority. Originally, IEEPA was used to target foreign governments; however, Presidents have increasingly targeted groups and individuals. While Presidents usually make use of IEEPA as an emergency power, Congress has also directed the use of IEEPA or expressed its approval of presidential emergency use in several statutes. IEEPA is the most frequently cited emergency authority when the President invokes NEA authorities to declare a national emergency. ( Figure 1 ). Rather than referencing the same set of emergencies, as had been the case with TWEA, IEEPA has required the President to declare a national emergency for each independent use. As a result, the number of national emergencies declared under the terms of the NEA has proliferated over the past four decades. Presidents declared only four national emergencies under the auspices of TWEA in the four decades prior to IEEPA's enactment. In contrast, Presidents have invoked IEEPA in 54 of the 61 declarations of national emergency issued under the National Emergen cies Act. As of March 1, 2019, there were 32 ongoing national emergencies; all but three involved IEEPA. Each year since 1990, Presidents have issued roughly 4.5 executive orders citing IEEPA and declared 1.5 new national emergencies citing IEEPA. ( Figure 2 ). On average, emergencies invoking IEEPA last nearly a decade. The longest emergency was also the first. President Jimmy Carter, in response to the Iranian hostage crisis of 1979, declared the first national emergency under the provisions of the National Emergencies Act and invoked IEEPA. Six successive Presidents have renewed that emergency annually for nearly forty years. As of March 1, 2019, that emergency is still in effect, largely to provide a legal basis for resolving matters of ownership of the Shah's disputed assets. That initial emergency aside, the length of emergencies invoking IEEPA has increased each decade. The average length of an emergency invoking IEEPA declared in the 1980s was four years. That average extended to 10 years for emergencies declared in the 1990s and 11 years for emergencies declared in the 2000s ( Figure 3 ). As such, the number of ongoing national emergencies has grown nearly continuously since the enactment of IEEPA and the NEA ( Figure 4 ). Between January 1, 1979, and January 1, 2019, there were on average 14 ongoing national emergencies each year, 13 of which invoked IEEPA. In most cases, the declared emergencies citing IEEPA have been geographically specific ( Figure 5 ). For example, in the first use of IEEPA, President Jimmy Carter issued an executive order that both declared a national emergency with respect to the "situation in Iran" and "blocked all property and interests in property of the Government of Iran [...]." Five months later, President Carter issued a second order dramatically expanding the scope of the first EO and effectively blocked the transfer of all goods, money, or credit destined for Iran by anyone subject to the jurisdiction of the United States. A further order expanded the coverage to block imports to the United States from Iran. Together, these orders touched upon virtually all economic contacts between any place or legal person subject to the jurisdiction of the United States and the territory and government of Iran. Many of the executive orders invoking IEEPA have followed this pattern of limiting the scope to a specific territory, government, or its nationals. Executive Order 12513, for example, prohibited "imports into the United States of goods and services of Nicaraguan origin" and "exports from the United States of goods to or destined for Nicaragua." The order likewise prohibited Nicaraguan air carriers and vessels of Nicaraguan registry from entering U.S. ports. Executive Order 12532 prohibited various transactions with the "Government of South Africa or to entities owned or controlled by that Government." While the majority (38) of national emergencies invoking IEEPA have been geographically specific, ten have lacked explicit geographic limitations. President George H.W. Bush declared the first geographically nonspecific emergency in response to the threat posed by the proliferation of chemical and biological weapons. Similarly, President George W. Bush declared a national emergency in response to the threat posed by "persons who commit, threaten to commit, or support terrorism." President Barack Obama declared emergencies to respond to the threats of "transnational criminal organizations" and "persons engaging in malicious cyber-enabled activities." Without explicit geographic limitations, these orders have included provisions that are global in scope. These geographically nonspecific emergencies have increased in frequency over the past 40 years—three of the ten have been declared since 2015. In addition to the erosion of geographic limitations, the stated motivations for declaring national emergencies have expanded in scope as well. Initially, stated rationales for declarations of national emergency citing IEEPA were short and often referenced either a specific geography or the specific actions of a government. Presidents found that circumstances like "the situation in Iran," or the "policies and actions of the Government of Nicaragua," constituted "unusual and extraordinary threat[s] to the national security and foreign policy of the United States" and would therefore declare a national emergency. The stated rationales have, however, expanded over time in both the length and subject matter. Presidents have increasingly declared national emergencies, in part, to respond to human and civil rights abuses, slavery, denial of religious freedom, political repression, public corruption, and the undermining of democratic processes. While the first reference to human rights violations as a rationale for a declaration of national emergency came in 1985, most of such references have come in the past twenty years. Table A-2 . Presidents have also expanded the nature of the targets of IEEPA sanctions. Originally, the targets of sanctions issued under IEEPA were foreign governments. The first use of IEEPA targeted "Iranian Government Property." Use of IEEPA quickly expanded to target geographically defined regions. Nevertheless, Presidents have also increasingly targeted groups, such as political parties or terrorist organizations, and individuals, such as supporters of terrorism or suspected narcotics traffickers. The first instances of orders directed at groups or persons were limited to foreign groups or persons. For example, in Executive Order 12978, President Bill Clinton targeted specific "foreign persons" and "persons determined [...] to be owned or controlled by, or to act for or on behalf of" such foreign persons. An excerpt is included below: Except to the extent provided in section 203(b) of IEEPA (50 U.S.C. 1702(b)) and in regulations, orders, directives, or licenses that may be issued pursuant to this order, and notwithstanding any contract entered into or any license or permit granted prior to the effective date, I hereby order blocked all property and interests in property that are or hereafter come within the United States, or that are or hereafter come within the possession or control of United States persons, of: (a) the foreign persons listed in the Annex to this order; (b)  foreign persons determined by the Secretary of the Treasury, in consultation with the Attorney General and the Secretary of State: (i) to play a significant role in international narcotics trafficking centered in Colombia; or (ii) materially to assist in, or provide financial or technological support for or goods or services in support of, the narcotics trafficking activities of persons designated in or pursuant to this order; and (c) persons determined by the Secretary of the Treasury, in consultation with the Attorney General and the Secretary of State, to be owned or controlled by, or to act for or on behalf of, persons designated in or pursuant to this order. However, in 2001, President George W. Bush issued Executive Order 13219 to target "persons who threaten international stabilization efforts in the Western Balkans." While the order was similar to that of Executive Order 12978, it removed the qualifier "foreign." As such, persons in the United States, including U.S. citizens, could be targets of the order. The following is an excerpt of the order: Except to the extent provided in section 203(b)(1), (3), and (4) of IEEPA (50 U.S.C. 1702(b)(1), (3), and (4)), the Trade Sanctions Reform and Export Enhancement Act of 2000 (title IX, P.L. 106-387 ), and in regulations, orders, directives, or licenses that may hereafter be issued pursuant to this order, and notwithstanding any contract entered into or any license or permit granted prior to the effective date, all property and interests in property of: (i)  the persons listed in the Annex to this order; and (ii)  persons designated by the Secretary of the Treasury, in consultation with the Secretary of State, because they are found: (A) to have committed, or to pose a significant risk of committing, acts of violence... Several subsequent invocations of IEEPA have similarly not been limited to foreign targets. In sum, presidential emergency use of IEEPA was directed at foreign states initially, with targets that were delimited by geography or nationality. Since the 1990s, however, Presidents have expanded the scope of their declarations to include individual persons, regardless of nationality or geographic location, who are engaged in specific activities. While IEEPA is often categorized as an emergency statute, Congress has used IEEPA outside of the context of national emergencies. When Congress legislates sanctions, it often authorizes or directs the President to use IEEPA authorities to impose those sanctions. In the Nicaragua Human Rights and Anticorruption Act of 2018, the most recent example, Congress directed the President to exercise "all powers granted to the President [by IEEPA] to the extent necessary to block and prohibit [certain transactions]." Penalties for violations by a person of a measure imposed by the President under the Act would be, likewise, determined by reference to IEEPA. The trend has been long-term. Congress first directed the President to make use of IEEPA authorities in 1986 as part of an effort to assist Haiti in the recovery of assets illegally diverted by its former government. That statute provided: The President shall exercise the authorities granted by section 203 of the International Emergency Economic Powers Act [50 USC 1702] to assist the Government of Haiti in its efforts to recover, through legal proceedings, assets which the Government of Haiti alleges were stolen by former president-for-life Jean Claude Duvalier and other individuals associated with the Duvalier regime. This subsection shall be deemed to satisfy the requirements of section 202 of that Act. [50 USC 1701] In directing the President to use IEEPA, Congress waived the requirement that he declare a national emergency (and none was declared). Subsequent legislation has followed this general pattern, with slight variations in language and specificity. The following is an example of current legislative language that has appeared in several recent statutes: (a) IN GENERAL.—The President shall impose the sanctions described in subsection (b) with respect to— ... (b) SANCTIONS DESCRIBED.— (1) IN GENERAL.—The sanctions described in this subsection are the following: (A) ASSET BLOCKING.—The exercise of all powers granted to the President by the International Emergency Economic Powers Act (50 U.S.C. 1701 et seq.) to the extent necessary to block and prohibit all transactions in all property and interests in property of a person determined by the President to be subject to subsection (a) if such property and interests in property are in the United States, come within the United States, or are or come within the possession or control of a United States person. ... (2) PENALTIES.—A person that violates, attempts to violate, conspires to violate, or causes a violation of paragraph (1)(A) or any regulation, license, or order issued to carry out paragraph (1)(A) shall be subject to the penalties set forth in subsections (b) and (c) of section 206 of the International Emergency Economic Powers Act (50 U.S.C. 1705) to the same extent as a person that commits an unlawful act described in subsection (a) of that section. Congress has also expressed, retroactively, its approval of unilateral presidential invocations of IEEPA in the context of a national emergency. In the Countering Iran's Destabilizing Activities Act of 2017, for example, Congress declared, "It is the sense of Congress that the Secretary of the Treasury and the Secretary of State should continue to implement Executive Order No. 13382." Presidents, however, have also used IEEPA to preempt or modify parallel congressional activity. On September 9, 1985, President Reagan, finding "that the policies and actions of the Government of South Africa constitute an unusual and extraordinary threat to the foreign policy and economy of the United States," declared a national emergency and limited transactions with South Africa. The President declared the emergency despite the fact that legislation limiting transactions with South Africa was quickly making its way through Congress. In remarks about the declaration, President Reagan stated that he had been opposed to the bill contemplated by Congress because unspecified provisions "would have harmed the very people [the U.S. was] trying to help." Nevertheless, members of the press at the time (and at least one scholar since) noted that the limitations imposed by the Executive Order and the provisions in legislation then winding its way through Congress were "substantially similar." In general, IEEPA has served as an integral part of the postwar international sanctions regime. The President, either through a declaration of emergency or via statutory direction, has used IEEPA to limit economic transactions in support of administrative and congressional national security and foreign policy goals. Much of the action taken pursuant to IEEPA has involved blocking transactions and freezing assets. Once the President declares that a national emergency exists, he may use the authority in Section 203 of IEEPA (Grants of Authorities; 50 U.S.C. § 1702) to investigate, regulate, or prohibit foreign exchange transactions, transfers of credit, transfers of securities, payments, and may take specified actions relating to property in which a foreign country or person has interest—freezing assets, blocking property and interests in property, prohibiting U.S. persons from entering into transactions related to frozen assets and blocked property, and in some instances denying entry into the United States. Pursuant to Section 203, Presidents have prohibited transactions with and blocked property of those designated as engaging in malicious cyber-enabled activities, including "interfering with or undermining election processes or institutions" [Executive Order 13694 of April 1, 2015, as amended; 50 U.S.C. § 1701 note. See also Executive Order 13848 of September 12, 2018; 83 F.R. 46843.]; prohibited transactions with and blocked property of those designated as illicit narcotics traffickers including foreign drug kingpins; prohibited transactions with and blocked property of those designated as engaging in human rights abuses or significant corruption; prohibited transactions related to illicit trade in rough diamonds; prohibited transactions with and blocked property of those designated as Transnational Criminal Organizations; prohibited transactions with "those who disrupt the Middle East peace process;" prohibited transactions related to overflights with certain nations; instituted and maintained maritime restrictions; prohibited transactions related to weapons of mass destruction, in coordination with export controls authorized by the Arms Export Control Act and the Export Administration Act of 1979, and in furtherance of efforts to deter the weapons programs of specific countries (i.e., Iran, North Korea); prohibited transactions those designated as "persons who commit, threaten to commit, or support terrorism;" maintained the dual-use export control system at times when its then-underlying authority, the Export Administration Act authority had lapsed; blocked property of and transactions with those designated as engaged in cyber activities that compromise critical infrastructures including election processes or the private sector's trade secrets; blocked property of and prohibited transactions with those designated as responsible for serious human rights abuse or engaged in corruption; blocked certain property of and transactions with foreign nationals of specific countries those designated as engaged in activities that constitute an extraordinary threat. No President has used IEEPA to place tariffs on imported products from a specific country or on products imported to the United States in general. However, IEEPA's similarity to TWEA, coupled with its relatively frequent use to ban imports and exports, suggests that such an action could happen. In addition, no President has used IEEPA to enact a policy that was primarily domestic in effect. Some scholars argue, however, that the interconnectedness of the global economy means it would probably be permissible to use IEEPA to take an action that was primarily domestic in effect. The ultimate disposition of assets frozen under IEEPA may serve as an important part of the leverage economic sanctions provide to influence the behavior of foreign actors. The President and Congress have each at times determined the fate of blocked assets to further foreign policy goals. Presidents have used frozen assets as a bargaining tool during foreign policy crises and to bring a resolution to such crises, at times by unfreezing the assets, returning them to the sanctioned entity or channeling them to a follow-on government. The following are some examples of how Presidents have made use of blocked assets to resolve foreign policy issues. President Carter invoked authority under IEEPA to impose trade sanctions against Iran, freezing Iranian assets in the United States, in response to the hostage crisis in 1979. On January 19, 1981, the United States and Iran entered into a series of executive agreements brokered by Algeria under which the hostages were freed, a portion of the blocked assets ($5.1 billion) was used to repay outstanding U.S. bank loans to Iran, another part ($2.8 billion) was returned directly to Iran, another $1 billion was transferred into a security account in the Hague to pay other U.S. claims against Iran as arbitrated by the Iran-U.S. Claims Tribunal (IUSCT), and an additional $2 billion remained blocked pending further agreement with Iran or decision of the Tribunal. The United States also undertook to freeze the assets of the former Shah's estate along with those of the Shah's close relatives pending litigation in U.S. courts to ascertain Iran's right to their return. Iran's litigation was unsuccessful, and none of the contested assets were returned to Iran. Presidents have also been able to channel frozen assets to opposition governments in cases where the United States continued to recognize a previous government that had been removed by coup d'état or otherwise replaced as the legitimate government of a country. For example, after Panamanian President Eric Arturo Delvalle tried to dismiss de facto military ruler General Manuel Noriega from his post as head of the Panamanian Defense Forces, which resulted in Delvalle's own dismissal by the Panamanian Legislative Assembly, President Reagan recognized Delvalle as the legitimate head of government and instituted economic sanctions against the Noriega regime. The Department of State advised U.S. banks not to disburse funds to the Noriega regime, and Delvalle was able to obtain court orders permitting him access to the funds. President Reagan issued Executive Order 12635, which blocked all property and interests in payments of the government of Panama, and the Department of the Treasury issued regulations requiring companies who owed money to Panama to pay those funds into an escrow account established at the Federal Reserve Bank of New York, which also held payments owed by the United States for the operation of the Panama Canal Commission. Some of the funds in the escrow account were used to pay the operating expenses of the Delvalle government. After the U.S. invasion of Panama, President George H.W. Bush lifted economic sanctions and used some of the frozen funds to repay debts owed by Panama to foreign creditors, with remaining funds returned to the successor government. In a similar more recent case, the Trump Administration's recognition of Venezuelan opposition leader Juan Guaidó as Venezuela's interim president permitted Guaidó access to Venezuelan government assets held at the United States Federal Reserve and other insured United States financial institutions. President Barrack Obama initially froze Venezuelan government assets in 2015, pursuant to IEEPA and the Venezuela Defense of Human Rights and Civil Society Act of 2014. After official recognition of Guaidó, the Trump Administration imposed new sanctions under IEEPA to freeze the assets of the main Venezuelan state-owned oil company, Petróleos de Venezuela (Pdvsa), which could both significantly reduce funds available to the regime of Nicolas Maduro and channel them to Guaidó. There is also precedent for using frozen foreign assets for purposes authorized by the U.N. Security Council. After the first war with Iraq, President George H.W. Bush ordered the transfer of frozen Iraqi assets derived from the sale of Iraqi petroleum held by U.S. banks to be transferred to a holding account in the Federal Reserve Bank of New York to fulfill "the rights and obligations of the United States under U.N. Security Council Resolution No. 778." The President cited a section of the United Nations Participation Act (UNPA), as well as IEEPA, as authority to take the action. The transferred funds were used to provide humanitarian relief and to finance the United Nations Compensation Commission, which was established to adjudicate claims against Iraq arising from the invasion. Other Iraqi assets remained frozen and accumulated interest until they were vested in 2003 (see below). In some cases, the United States has ended sanctions and returned frozen assets to successor governments. In the case of the former Yugoslavia, for example, in 2003, $237.6 million in frozen funds belonging to the Central Bank of the Socialist Federal Republic of Yugoslavia were transferred to the central banks of the successor states. In the case of Afghanistan, $217 million in frozen funds belonging to the Taliban were released to the Afghan Interim Authority in January 2002. The executive branch has traditionally resisted congressional efforts to vest foreign assets to pay U.S. claimants without first obtaining a settlement agreement with the country in question. Congress has overcome such resistance in the case of foreign governments that have been designated as "State Supporters of Terrorism." U.S. nationals who are victims of state-supported terrorism involving designated states have been able to sue those countries for damages under an exception to the Foreign Sovereign Immunities Act (FSIA) since 1996. To facilitate the payment of judgments under the exception, Congress passed Section 117 of the Treasury and General Government Appropriations Act, 1999, which further amended the FSIA by allowing attachment and execution against state property with respect to which financial transactions are prohibited or regulated under Section 5(b) TWEA, Section 620(a) of the Foreign Assistance Act (authorizing the trade embargo against Cuba), or Sections 202 and 203 of IEEPA, or any orders, licenses or other authority issued under these statutes. Because of the Clinton Administration's continuing objections, however, Section 117 also gave the President authority to "waive the requirements of this section in the interest of national security," an authority President Clinton promptly exercised in signing the statute into law. The Section 117 waiver authority protecting blocked foreign government assets from attachment to satisfy terrorism judgments has continued in effect ever since, prompting Congress to take other actions to make frozen assets available to judgment holders. Congress enacted §2002 of the Victims of Trafficking and Violence Protection Act of 2000 (VTVPA) to mandate the payment from frozen Cuban assets of compensatory damages awarded against Cuba under the FSIA terrorism exception on or prior to July 20, 2000. The Department of the Treasury subsequently vested $96.7 million in funds generated from long-distance telephone services between the United States and Cuba in order to compensate claimants in Alejandre v. Republic of Cuba , the lawsuit based on the1996 downing of two unarmed U.S. civilian airplanes by the Cuban air force. Another payment of more than $7 million was made using vested Cuban assets to a Florida woman who had won a lawsuit against Cuba based on her marriage to a Cuban spy. As unpaid judgments against designated state sponsors of terrorism continued to mount, Congress enacted the Terrorism Risk Insurance Act (TRIA). Section 201 of TRIA overrode long-standing objections by the executive branch to make the frozen assets of terrorist states available to satisfy judgments for compensatory damages against such states (and organizations and persons) as follows: Notwithstanding any other provision of law, and except as provided in subsection (b), in every case in which a person has obtained a judgment against a terrorist party on a claim based upon an act of terrorism, or for which a terrorist party is not immune under section 1605(a)(7) of title 28, United States Code, the blocked assets of that terrorist party (including the blocked assets of any agency or instrumentality of that terrorist party) shall be subject to execution or attachment in aid of execution in order to satisfy such judgment to the extent of any compensatory damages for which such terrorist party has been adjudged liable. Subsection (b) of Section 201 provided waiver authority "in the national security interest," but only with respect to frozen foreign government "property subject to the Vienna Convention on Diplomatic Relations or the Vienna Convention on Consular Relations." When Congress amended the FSIA in 2008 to revamp the terrorism exception, it provided that judgments entered under the new exception could be satisfied out of the property of a foreign state notwithstanding the fact that the property in question is regulated by the United States government pursuant to TWEA or IEEPA. Congress has also directed that the proceeds from certain sanctions violations be paid into a fund for providing compensation to the former hostages of Iran and terrorist state judgment creditors. To fund the program, Congress designated that certain real property and bank accounts owned by Iran and forfeited to the United States could go into the United States Victims of State Sponsored Terrorism Fund, along with the sum of $1,025,000,000, representing the amount paid to the United States pursuant to the June 27, 2014, plea agreement and settlement between the United States and BNP Paribas for sanctions violations. The fund is replenished through criminal penalties and forfeitures for violations of IEEPA or TWEA-based regulations, or any related civil or criminal conspiracy, scheme, or other federal offense related to doing business or acting on behalf of a state sponsor of terrorism. Half of all civil penalties and forfeitures relating to the same offenses are also deposited into the fund. A number of lawsuits seeking to overturn actions taken pursuant to IEEPA have made their way through the judicial system, including challenges to the breadth of congressionally delegated authority and assertions of violations of constitutional rights. As demonstrated below, most of these challenges have failed. The few challenges that succeeded did not seriously undermine the overarching statutory scheme for sanctions. The breadth of presidential power under IEEPA is illustrated by the Supreme Court's 1981 opinion in Dames & Moore v. Regan . In Dames & Moore , petitioners had challenged President Carter's executive order establishing regulations to further compliance with the terms of the Algiers Accords, which the President had entered into to end the hostage crisis with Iran. Under these agreements, the United States was obligated (1) to terminate all legal proceedings in U.S. courts involving claims of U.S. nationals against Iran, (2) to nullify all attachments and judgments, and (3) to resolve outstanding claims exclusively through binding arbitration in the Iran-U.S. Claims Tribunal (IUSCT). The President, through executive orders, revoked all licenses that permitted the exercise of "any right, power, or privilege" with regard to Iranian funds, nullified all non-Iranian interests in assets acquired after a previous blocking order, and required banks holding Iranian assets to transfer them to the Federal Reserve Bank of New York to be held or transferred as directed by the Secretary of the Treasury. Dames and Moore had sued Iran for breach of contract to recover compensation for work performed. The district court had entered summary judgment in favor of Dames and Moore and issued an order attaching certain Iranian assets for satisfaction of any judgment that might result, but stayed the case pending appeal. The executive orders and regulations implementing the Algiers Accords resulted in the nullification of this prejudgment attachment and the dismissal of the case against Iran, directing that it be filed at the IUSCT. In response, Dames and Moore sued the government. The plaintiffs claimed that the President and the Secretary of the Treasury exceeded their statutory and constitutional powers to the extent they adversely affected Dames and Moore's judgment against Iran, the execution of that judgment, the prejudgment attachments, and the plaintiff's ability to continue to litigate against the Iranian banks. The government defended its actions, relying largely on IEEPA, which provided explicit support for most of the measures taken—nullification of the prejudgment attachment and transfer of the property to Iran—but could not be read to authorize actions affecting the suspension of claims in U.S. courts. Justice Rehnquist wrote for the majority: Although we have declined to conclude that the IEEPA…directly authorizes the President's suspension of claims for the reasons noted, we cannot ignore the general tenor of Congress' legislation in this area in trying to determine whether the President is acting alone or at least with the acceptance of Congress. As we have noted, Congress cannot anticipate and legislate with regard to every possible action the President may find it necessary to take or every possible situation in which he might act. Such failure of Congress specifically to delegate authority does not, "especially . . . in the areas of foreign policy and national security," imply "congressional disapproval" of action taken by the Executive. On the contrary, the enactment of legislation closely related to the question of the President's authority in a particular case which evinces legislative intent to accord the President broad discretion may be considered to "invite" "measures on independent presidential responsibility." At least this is so where there is no contrary indication of legislative intent and when, as here, there is a history of congressional acquiescence in conduct of the sort engaged in by the President. The Court remarked that Congress's implicit approval of the long-standing presidential practice of settling international claims by executive agreement was critical to its holding that the challenged actions were not in conflict with acts of Congress. For support, the Court cited to Justice Frankfurter's concurrence in Youngstown Sheet and Tube Co. v. Sawyer stating that "a systematic, unbroken, executive practice, long pursued to the knowledge of the Congress and never before questioned … may be treated as a gloss on 'Executive Power' vested in the President by § 1 of Art. II." Consequently, it may be argued that Congress's exclusion of certain express powers in IEEPA do not necessarily preclude the President from exercising them, at least where a court finds sufficient precedent exists. Lower courts have examined IEEPA under a number of other constitutional doctrines. Courts have reviewed whether Congress violated the non-delegation principle of separation of powers by delegating too much power to the President to legislate, in particular by creating new crimes. These challenges have generally failed. As the U.S. Court of Appeals for the Second Circuit explained while evaluating IEEPA, delegations of congressional authority are constitutional so long as Congress provides through a legislative act an "intelligible principle" governing the exercise of the delegated authority. Even if the standards are higher for delegations of authority to define criminal offenses, the court held, IEEPA provides sufficient guidance. The court stated: The IEEPA "meaningfully constrains the [President's] discretion," by requiring that "[t]he authorities granted to the President ... may only be exercised to deal with an unusual and extraordinary threat with respect to which a national emergency has been declared." And the authorities delegated are defined and limited. The Second Circuit found it significant that "IEEPA relates to foreign affairs—an area in which the President has greater discretion," bolstering its view that IEEPA does not violate the non-delegation doctrine. The U.S. Court of Appeals for the Eleventh Circuit considered whether Section 207(b) of IEEPA is an unconstitutional legislative veto. That provision states: The authorities described in subsection (a)(1) may not continue to be exercised under this section if the national emergency is terminated by the Congress by concurrent resolution pursuant to section 202 of the National Emergencies Act [50 U.S.C. § 1622] and if the Congress specifies in such concurrent resolution that such authorities may not continue to be exercised under this section. In U.S. v. Romero-Fernandez , two defendants convicted of violating the terms of an executive order issued under IEEPA argued on appeal that IEEPA was unconstitutional, in part, because of the above provision. The Eleventh Circuit accepted that the provision was an unconstitutional legislative veto (as conceded by the government) based on INS v. Chadha , in which the Supreme Court held that Congress cannot void the exercise of power by the executive branch through concurrent resolution, but can act only through bicameral passage followed by presentment of the law to the President. The Eleventh Circuit nevertheless upheld the defendants' convictions for violations of IEEPA regulations, holding that the legislative veto provision was severable from the rest of the statute. Courts have also addressed whether certain actions taken pursuant to IEEPA have effected an uncompensated taking of property rights in violation of the Fifth Amendment. The Fifth Amendment's Takings Clause prohibits "private property [from being] taken for public use, without just compensation." The Fifth Amendment's prohibitions apply as well to regulatory takings, in which the government does not physically take property but instead imposes restrictions on the right of enjoyment that decreases the value of the property or right therein. The Supreme Court has held that the nullification of prejudgment attachments pursuant to regulations issued under IEEPA was not an uncompensated taking, suggesting that the reason for this position was the contingent nature of the licenses that had authorized the attachments. The Court also suggested that the broader purpose of the statute supported the view that there was no uncompensated taking: This Court has previously recognized that the congressional purpose in authorizing blocking orders is "to put control of foreign assets in the hands of the President...." Such orders permit the President to maintain the foreign assets at his disposal for use in negotiating the resolution of a declared national emergency. The frozen assets serve as a "bargaining chip" to be used by the President when dealing with a hostile country. Accordingly, it is difficult to accept petitioner's argument because the practical effect of it is to allow individual claimants throughout the country to minimize or wholly eliminate this "bargaining chip" through attachments, garnishments, or similar encumbrances on property. Neither the purpose the statute was enacted to serve nor its plain language supports such a result. Similarly, a lower court held that the extinguishment of contractual rights due to sanctions enacted pursuant to IEEPA does not amount to a regulatory taking requiring compensation under the Fifth Amendment. Even though the plaintiff suffered "obvious economic loss" due to the sanctions regulations, that factor alone was not enough to sustain plaintiff's claim of a compensable taking. The court quoted long-standing Supreme Court precedent to support its finding: A new tariff, an embargo, a draft, or a war may inevitably bring upon individuals great losses; may, indeed, render valuable property almost valueless. They may destroy the worth of contracts. But whoever supposed that, because of this, a tariff could not be changed, or a non-intercourse act, or an embargo be enacted, or a war be declared? .... [W]as it ever imagined this was taking private property without compensation or without due process of law? Accordingly, it seems unlikely that entities whose business interests are harmed by the imposition of sanctions pursuant to IEEPA will be entitled to compensation from the government for their losses. Persons whose assets have been directly blocked by the U.S. Department of the Treasury Office of Foreign Assets Control (OFAC) pursuant to IEEPA have likewise found little success challenging the loss of the use of their assets as uncompensated takings. Many courts have recognized that a temporary blocking of assets does not constitute a taking because it is a temporary action that does not vest title in the United States. This conclusion is apparently so even if the blocking of assets necessitates the closing altogether of a business enterprise. In some circumstances, however, a court may analyze at least the initial blocking of assets under a Fourth Amendment standard for seizure. One court found a blocking to be unreasonable under a Fourth Amendment standard where there was no reason that OFAC could not have first obtained a judicial warrant. Some persons whose assets have been blocked have asserted that their right to due process has been violated. The Due Process Clause of the Fifth Amendment provides that no person shall be deprived of life, liberty, or property, without due process of law. Where one company protested that the blocking of its assets without a pre-deprivation hearing violated its right to due process, a district court found that a temporary deprivation of property does not necessarily give rise to a right to notice and an opportunity to be heard. A second district court stated that the exigencies of national security and foreign policy considerations that are implicated in IEEPA cases have meant that OFAC historically has not provided pre-deprivation notice in sanctions programs. A third district court stated that OFAC's failure to provide a charitable foundation with notice or a hearing prior to its designation as a terrorist organization and blocking of its assets did not violate its right to procedural due process, because the OFAC designation and blocking order serve the important governmental interest of combating terrorism by curtailing the flow of terrorist financing. That same court also held that prompt action by the government was necessary to protect against the transfer of assets subject to the blocking order. In Al Haramain Islamic Foundation v. U.S. Department of Treasury , the U.S. Court of Appeals for the Ninth Circuit considered whether OFAC's use of classified information without any disclosure of its content in its decision to freeze the assets of a charitable organization, and its failure to provide adequate notice and a meaningful opportunity to respond, violated the organization's right to procedural due process. The court applied the balancing test set forth by the Supreme Court in its landmark administrative law case Mathews v. Eldridge to resolve these questions. Under the Eldridge test, to determine if an individual has received constitutional due process, courts must weigh: (1) [the person's or entity's] private property interest, (2) the risk of an erroneous deprivation of such interest through the procedures used, as well as the value of additional safeguards, and (3) the Government's interest in maintaining its procedures, including the burdens of additional procedural requirements." While weighing the interests and risks at issue in Al Haramain , the Ninth Circuit found the organization's property interest to be significant: By design, a designation by OFAC completely shutters all domestic operations of an entity. All assets are frozen. No person or organization may conduct any business whatsoever with the entity, other than a very narrow category of actions such as legal defense. Civil penalties attach even for unwitting violations. Criminal penalties, including up to 20 years' imprisonment, attach for willful violations. For domestic organizations such as AHIF–Oregon, a designation means that it conducts no business at all. The designation is indefinite. Although an entity can seek administrative reconsideration and limited judicial relief, those remedies take considerable time, as evidenced by OFAC's long administrative delay in this case and the ordinary delays inherent in our judicial system. In sum, designation is not a mere inconvenience or burden on certain property interests; designation indefinitely renders a domestic organization financially defunct. Nevertheless, the court found "the government's interest in national security [could not] be understated." In evaluating the government's interest in maintaining its procedures, the Ninth Circuit explained that the Constitution requires that the government "take reasonable measures to ensure basic fairness to the private party and that the government follow procedures reasonably designed to protect against erroneous deprivation of the private party's interests." While the Ninth Circuit had previously held that the use of undisclosed information in a case involving the exclusion of certain longtime resident aliens should be considered presumptively unconstitutional, the court found that the presumption had been overcome in this case. The Ninth Circuit noted that all federal courts that have considered the argument that OFAC may not use undisclosed classified information in making its determinations have rejected it. Although the court found that OFAC's failure to provide even an unclassified summary of the information at issue was a violation of the organization's due process rights, the court deemed the error harmless because it would not likely have affected the outcome of the case. In the same case, the Ninth Circuit also considered the organization's argument that it had been denied adequate notice and an opportunity to be heard. Specifically, the organization asserted that OFAC had refused to disclose its reasons for investigating and designating the organization, leaving it unable to respond adequately to OFAC's unknown suspicions. Because OFAC had provided the organization with only one document to support its designation over the four-year period between the freezing of its assets and the redesignation of the organization as a specially designated global terrorist (SDGT), the court agreed that the organization had been deprived of due process rights. However, the court found that this error too was harmless. Some courts have considered whether asset blocking or penalties imposed pursuant to regulations promulgated under IEEPA have violated the subjects' First Amendment rights to free association, free speech, or religion. Challenges on these grounds have typically failed. Courts have held that there is no First Amendment right to support terrorists. The U.S. Court of Appeals for the District of Columbia Circuit distinguished advocacy from financial support and held that the blocking of assets affected only the ability to provide financial support, but did not implicate the organization's freedom of association. Similarly, a district court interpreted relevant case law to hold that government actions prohibiting charitable contributions are subject to intermediate scrutiny rather than strict scrutiny, a higher standard that applies to political contributions. With respect to a free speech challenge brought by a charitable organization whose assets were temporarily blocked during the pendency of an investigation, a district court explained that "when 'speech' and 'nonspeech' elements are combined in the same course of conduct, a sufficiently important government interest in regulating the nonspeech element can justify incidental limitations on First Amendment freedoms." Accordingly, the district court applied the following test to determine whether the designations and blocking actions were lawful. Citing the Supreme Court's opinion in United States v. O'Brien , the court stated that a government regulation is sufficiently justified if: it is within the constitutional power of the government; it furthers an important or substantial governmental interest; the governmental interest is unrelated to the suppression of free expression; and the incidental restriction on alleged First Amendment freedoms is no greater than is essential to the furtherance of that interest. The court found the government's actions to fall within the bounds of this test: First, the President clearly had the power to issue the Executive Order. Second, the Executive Order promotes an important and substantial government interest—that of preventing terrorist attacks. Third, the government's action is unrelated to the suppression of free expression; it prohibits the provision of financial and other support to terrorists. Fourth, the incidental restrictions on First Amendment freedoms are no greater than necessary. However, with respect to an organization that was not itself designated as an SDGT but wished to conduct coordinated advocacy with another organization that was so designated, one appellate court found that an OFAC regulation barring such coordinated advocacy based on its content was subject to strict scrutiny. Accordingly, the court rejected the government's reliance on the Supreme Court's decision in Holder v. Humanitarian Law Project to find that the regulation impermissibly implicated the organization's right to free speech. Accordingly, there may be some circumstances where the First Amendment protects speech coordinated with (but not on behalf of) an organization designated as an SDGT. Until the recent enactment of the Export Control Reform Act of 2018, export of dual use goods and services was regulated pursuant to the authority of the Export Administration Act (EAA), which was subject to periodic expiry and reauthorization. President Reagan was the first President to use IEEPA as a vehicle for continuing the enforcement of the EAA's export controls. After Congress did not extend the expired EAA, President Reagan issued Executive Order 12444 in 1983, finding that "unrestricted access of foreign parties to United States commercial goods, technology, and technical data and the existence of certain boycott practices of foreign nations constitute, in light of the expiration of the Export Administration Act of 1979, an unusual and extraordinary threat to the national security." Although the EAA had been reauthorized for short periods since its initial expiration in 1983, every subsequent President utilized the authorities granted under IEEPA to maintain the existing system of export controls during periods of lapse. Figure 1 . In the latest iteration, President George W. Bush issued Executive Order 13222 in 2001, finding the existence of a national emergency with respect to the expiration of the EAA and directing—pursuant to the authorities allocated under IEEPA—that "the provisions for administration of the [EAA] shall be carried out under this order so as to continue in full force and effect…the export control system heretofore maintained." Presidents Obama and Trump annually extended the 2001 executive order. Courts have generally treated this arrangement as authorized by Congress, although certain provisions of the EAA in effect under IEEPA have led to challenges. The determining factor appears to be whether IEEPA itself provides the President the authority to carry out the challenged action. In one case, the U.S. Court of Appeals for the Fifth Circuit upheld a conviction for an attempt to violate the regulations even though the EAA had expired and did not expressly criminalize such attempts. The circuit court rejected the defendants' argument that the President had exceeded his delegated authority under the EEA by "enlarging" the crimes punishable under the regulations. Nevertheless, a district court held that the conspiracy provisions of the EAA regulations were rendered inoperative by the lapse of the EAA and "could not be repromulgated by executive order under the general powers that IEEPA vests in the President." The district court found that, even if Congress intended to preserve the operation of the EAA through IEEPA, that intent was limited by the scope of the statutes' substantive coverage at the time of IEEPA's enactment, when no conspiracy provision existed in either statute. The U.S. Court of Appeals for the D.C. Circuit upheld the application of the EAA as a statute permitting the government to withhold information under exemption 3 of the Freedom of Information Act (FOIA), which exempts from disclosure information exempted from disclosure by statute, even though the EAA had expired. Referring to legislative history it interpreted as congressional approval of the use of IEEPA to continue the EAA provisions during periods of lapse, the court stated: Although the legislative history does not refer to the EAA's confidentiality provision, it does evince Congress's intent to authorize the President to preserve the operation of the export regulations promulgated under the EAA. Moreover, it is significant for purposes of determining legislative intent that Congress acted with the knowledge that the EAA's export regulations had long provided for confidentiality and that the President's ongoing practice of extending the EAA by executive order had always included these confidentiality protections. The D.C. Circuit distinguished this holding in a later case involving appellate jurisdiction over a decision by the Department of Commerce to apply sanctions for a company's violation of the EAA regulations. Pursuant to the regulations and under the direction of the Commerce Department, the company sought judicial review directly in the D.C. Circuit. The D.C. Circuit, however, concluded that it lacked jurisdiction: This court would have jurisdiction pursuant to the President's order only if the President has the authority to confer jurisdiction—an authority that, if it exists, must derive from either the Executive's inherent power under the Constitution or a permissible delegation of power from Congress. The former is unavailing, as the Constitution vests the power to confer jurisdiction in Congress alone. Whether the executive order can provide the basis of our jurisdiction, then, turns on whether the President can confer jurisdiction on this court under the auspices of IEEPA…..We conclude that the President lacks that power. Nothing in the text of IEEPA delegates to the President the authority to grant jurisdiction to any federal court. Consequently, the appeal of the agency decision was determined to belong in the district court according to the default rule under the Administrative Procedure Act (APA). Congress may wish to address a number of issues with respect to IEEPA; two are addressed here. The first pertains to how Congress has delegated its authority under IEEPA and its umbrella statute, the NEA. The second pertains to choices made in the Export Control Reform Act of 2018. Although the stated aim of the drafters of the NEA and IEEPA was to restrain the use of emergency powers, the use of such powers has expanded by several measures. Presidents declare national emergencies and renew them for years or even decades. The limitation of IEEPA to transactions involving some foreign interest was intended to limit IEEPA's domestic application. However, globalization has eroded that limit, as few transactions today do not involve some foreign interest. Many of the other criticisms of TWEA that IEEPA was supposed to address—consultation, time limits, congressional review, scope of power, and logical relationship to the emergency declared—are criticisms that scholars levy against IEEPA today. In general, three common criticisms are levied by scholars with respect to the structure of the NEA and IEEPA that may be of interest to Congress. First, the NEA and IEEPA do not define the phrases "national emergency" and "unusual and extraordinary threat" and Presidents have interpreted these terms broadly. Second, the scope of presidential authority under IEEPA has become less constrained in a highly globalized era. Third, owing to rulings by the Supreme Court and amendments to the NEA, Congress would likely have to have a two-thirds majority rather than a simple majority to terminate a national emergency. Despite these criticisms, Congress has not acted to terminate or otherwise express displeasure with an emergency declaration invoking IEEPA. This absence of any explicit statement of disapproval, coupled with explicit statements of approval in some instances, may indicate congressional approval of presidential use of IEEPA thus far. Arguably, then, IEEPA could be seen as an effective tool for carrying out the will of Congress. Neither the NEA nor IEEPA define what constitutes a "national emergency." IEEPA conditions its invocation in a declaration on its necessity for dealing with an "unusual and extraordinary threat … to the national security, foreign policy, or economy of the United States." In the markup of IEEPA in the House, Fred Bergsten, then-Assistant Secretary for International Affairs in the Department of the Treasury, praised the requirement that a national emergency for the purposes of IEEPA be "based on an unusual and extraordinary threat" because such language "emphasizes that such powers should be available only in true emergencies." Because "unusual" and "extraordinary" are also undefined, the usual and ordinary invocation of the statute seems to conflict with those statutory conditions. If Congress wanted to refine the meaning of "national emergency" or "unusual and extraordinary threat," it could do so through statute. Additionally, Congress could consider requiring some sort of factual finding by a court prior to, or shortly after, the exercise of any authority, such as under the First Militia Act of 1792 or the Foreign Intelligence Surveillance Act. However, Congress may consider that the ambiguity in the existing statute provides the executive with the flexibility necessary to address national emergencies with the requisite dispatch. While IEEPA nominally applies only to foreign transactions, the breadth of the phrase, "any interest of any foreign country or a national thereof" has left a great deal of room for executive discretion. The interconnectedness of the modern global economy has left few major transactions in which a foreign interest is not involved. As a result, at least one scholar has concluded, "the exemption of purely domestic transactions from the President's transaction controls seems to be a limitation without substance." Presidents have used IEEPA since the 1980s to control exports by maintaining the dual-use export control system, enshrined in the Export Administration Regulations (EAR) in times when its underlying authorization, the Export Administration Act (EAA), periodically expired. During those times when Congress did not reauthorize the EAA, Presidents have declared emergencies to maintain the dual-use export control system. The current emergency has been ongoing since 2001. While Presidents have used IEEPA to implement trade restrictions against adversaries, it has not been used as a general way to impose tariffs. However, as noted above, President Nixon used TWEA to impose a 10% ad valorem tariff on goods entering the United States to avoid a balance of payments crisis after he ended the convertibility of the U.S. dollar to gold. Although the use of TWEA in this instance was criticized at the time, it does not appear that the subsequent reforms resulting in the enactment of IEEPA would prevent the President from imposing tariffs or other restrictions on trade. However, the availability of diverse other authorities for addressing trade, including for national security purposes, makes the use of IEEPA for this purpose unlikely. The scope of powers over individual targets is also extensive. Under IEEPA, the President has the power to prohibit all financial transactions with individuals designated by Executive Order. Such power allows the President to block all the assets of a U.S. citizen or permanent resident. Such uses of IEEPA may reflect the will of Congress or they may represent a grant of authority that may have gone beyond what Congress originally intended. The heart of the curtailment of presidential power by the NEA and IEEPA was the provision that Congress could terminate a state of emergency declared pursuant to the NEA with a concurrent resolution. When the "legislative veto" was struck down by the Supreme Court (see above), it left Congress with a steeper climb—presumably requiring passage of a veto-proof joint resolution—to terminate a national emergency declared under the NEA. Two such resolutions have ever been introduced and neither declarations of emergency involved IEEPA. The lack of congressional action here could be the result of the necessity of obtaining a veto-proof majority or it could be that the use of IEEPA has so far reflected the will of Congress. If Congress wanted to assert more authority over the use of IEEPA, it could amend the NEA or IEEPA to include a "sunset provision," terminating any national emergency after a certain number of days. At least one scholar has recommended such an amendment. Alternatively, Congress could amend IEEPA to provide for a review mechanism that would give Congress an active role. In the Senate during the 115 th Congress, for example, Senator Mike Lee introduced the Global Trade Accountability Act of 2017 required the President to report to Congress on any proposed trade action (including the use of IEEPA), including a description of the proposal together with a list of items to be affected, an economic impact study of the proposal including potential retaliation. Congress, using expedited procedures, would need to approve the President's action through a joint resolution within a 60-day period. The legislation would have provided for a temporary one-time unilateral trade action for a 90-day period. Similarly, in the 116 th Congress, Senator Lee introduced S. 764 , a bill to provide for congressional approval of national emergency declarations, and for other purposes, which would amend the NEA to require an act of Congress within 30 days to allow a national emergency to continue. Another approach would establish a means for Congress to pass a resolution of disapproval if IEEPA authorities are invoked. An example of this approach is the Trade Authority Protection Act (H.R. 5760). After the submission of similar reporting requirement to S. 177 (above), Congress could, under Congressional Review Act (CRA)-style procedures, pass a joint resolution of disapproval. Congress does have the authority to pass a joint resolution under IEEPA, as noted above, but the use of CRA procedures would allow for certain expedited consideration. Alternatively, Congress could use any of these mechanisms to amend the current disapproval resolution process in IEEPA or the NEA itself. In testimony before the House Committee on International Relations in 1977, Professor Harold G. Maier summed up the main criticisms of TWEA: Section 5(b)'s effect is no longer confined to "emergency situations" in the sense of existing imminent danger. The continuing retroactive approval, either explicit or implicit, by Congress of broad executive interpretations of the scope of powers which it confers has converted the section into a general grant of legislative authority to the President…" Like TWEA before it, IEEPA sits at the center of the modern U.S. sanction regime. Like TWEA before it, Congress has often approved explicitly of the President's use of IEEPA. In several circumstances, Congress has directed the President to impose a variety of sanctions under IEEPA and waived the requirement of an emergency declaration. Even when Congress has not given explicit approval, no Member of Congress has ever introduced a resolution to terminate a national emergency citing IEEPA. The NEA requires that both houses of Congress meet every six months to consider a vote on a joint resolution on terminating an emergency. Neither house has ever met to do so. In response to concerns over the scale and scope of the emergency economic powers granted by IEEPA, supporters of the status quo would argue that Congress has implicitly and explicitly expressed approval of the statute and its use. In 2018, Congress passed the Export Control Reform Act (ECRA). The legislation repealed the expired Export Administration Act of 1979, the regulations of which had been continued by reference to IEEPA since 2001. The ECRA became the new statutory authority for Export Administration Regulations. Nevertheless, several export controls addressed in the Export Administration Act of 1979 were not updated in the Export Control Reform Act of 2018; instead, Congress chose to require the President to continue to use IEEPA to continue to implement the three sections of the Export Administration Act of 1979 that were not repealed. Going forward, Congress may wish to revisit these provisions, which all relate to deterring the proliferation of weapons of mass destruction. Appendix A. NEA and IEEPA Use

 

 Report 2:
The national pipeline system consists of more than 2.7 million miles of networked pipelines transporting oil, natural gas, and other hazardous liquids. Hazardous liquid and natural gas pipelines—primarily buried underground in the continental United States—run under remote and open terrain, as well as densely populated areas. These pipelines are of three main types: Hazardous liquid: About 216,000 miles of hazardous liquid pipeline transport crude oil, diesel fuel, gasoline, jet fuel, anhydrous ammonia, and carbon dioxide. Natural gas transmission and storage: About 319,000 miles of pipeline—mostly interstate—transport natural gas from sources to communities. Natural gas distribution: About 2.2 million miles of pipeline—mostly intrastate—transport natural gas from transmission sites to consumers. Figure 1 depicts the network of hazardous liquid and natural gas transmission pipelines in the United States. More than 3,000 pipeline companies operate the nation’s pipeline systems, which can traverse multiple states and the U.S. borders with Canada and Mexico. Many pipeline systems are comprised of the pipelines themselves, as well as a variety of facilities, such as storage tanks, compressor stations, and control centers. Most pipeline systems are monitored and moderated through automated ICS or Supervisory Control and Data Acquisition (SCADA) systems using remote sensors, signals, and preprogramed parameters to activate and deactivate valves and pumps to maintain flows within tolerances. Federal agencies and pipeline operators determine the criticality of pipeline systems and their facilities based on their importance to the nation’s energy infrastructure; service to installations critical to national defense; or, if attacked, have the potential to cause mass casualties and significant impact on public drinking water affecting major population centers. Accordingly, those determined to be critical merit increased attention to security. However, as we previously reported, the inherent design and operation of U.S. pipeline systems may reduce some potential impacts of lost service. The pipeline sector is generally considered to be resilient and versatile. Historically, pipeline operators have been able to quickly respond to the adverse consequences of an incident—whether it is damage from a major hurricane or a backhoe—and quickly restore pipeline service. Pipeline infrastructure also includes redundancies such as parallel pipelines or interconnections that enable operators to reroute material through the network. Figure 2 depicts the U.S. pipeline system, its basic components, examples of vulnerabilities, and the entities to which it supplies energy and raw materials. These entities include utility companies, airports, military sites, and industrial and manufacturing facilities. According to TSA, pipelines are vulnerable to physical attacks—including the use of firearms or explosives—largely due to their stationary nature, the volatility of transported products, and the dispersed nature of pipeline networks spanning urban and outlying areas. The nature of the transported commodity and the potential effect of an attack on national security, commerce, and public health make some pipelines and their assets more attractive targets for attack. Oil and gas pipelines have been and continue to be targeted by terrorists and other malicious groups globally. Terrorists have also targeted U.S. pipelines, but have not succeeded in attacking them. Further, environmental activists and lone actors seeking to halt the construction of new pipelines through sabotage have recently emerged as a new threat to pipelines. For example, in March 2017, activists used blowtorches to cut holes in empty portions of the Dakota Access Pipeline in two states. In February 2017, local law enforcement officers fatally shot a man who used an assault rifle to damage the Sabal Trail Pipeline, a natural gas pipeline under construction in Florida. The sophisticated computer systems that pipeline operations rely on are also vulnerable to various cyber threats. According to DOE, the frequency, scale, and sophistication of cyber threats have increased, and attacks have become easier to launch. NCCIC reported that the energy sector, which includes pipelines, experienced more cyber incidents than any sector from 2013 to 2015, accounting for 35 percent of the 796 incidents reported by all critical infrastructure sectors. In 2016, NCCIC reported that the energy sector was the third most frequently attacked sector. Further, according to DOE, the cost of preventing and responding to cyber incidents in the energy sector is straining the ability of companies to adequately protect their critical cyber systems. For example, a 2015 study by the Ponemon Institute estimated the annualized cost of cyber crime for an average energy company to be about $28 million. Ineffective protection of cyber assets from these threats can increase the likelihood of security incidents and cyber attacks that disrupt critical operations; lead to inappropriate access to and disclosure, modification, or destruction of sensitive information; and threaten national security, economic well-being, and public health and safety. Unintentional or nonadversarial threat sources may include failures in equipment or software due to aging, resource depletion, and errors made by end users. They also include natural disasters and failures of critical infrastructure on which the organization depends, but that are outside of the control of the organization. Intentional or adversarial threats may include corrupt employees, criminal groups, terrorists, and nations that seek to leverage the organization’s dependence on cyber resources (i.e., information in electronic form, information and communications technologies, and the communications and information-handling capabilities provided by those technologies). These threat adversaries vary in terms of their capabilities, their willingness to act, and their motives, which can include seeking monetary gain or seeking an economic, political, or military advantage. Cyber threat adversaries make use of various techniques, tactics, practices, and exploits to adversely affect an organization’s computers, software, or networks, or to intercept or steal valuable or sensitive information. For example, an attacker could infiltrate a pipeline’s operational systems via the internet or other communication pathways to potentially disrupt its service and cause spills, releases, explosions, or fires. Moreover, ICS, which were once largely isolated from the Internet and the company’s information technology systems, are increasingly connected in modern energy systems, allowing cyber attacks to originate in business systems and migrate to operational systems. For example, malicious nation-state actors used spear-phishing and other similar approaches in 2018 against energy sector organizations to gain access to their business systems, conduct reconnaissance, and collect information about their ICS. Similarly, in April 2012, the Industrial Control Systems Cyber Emergency Response Team reported that an unidentified cyber attacker had conducted a series of cyber intrusions into U.S. natural gas pipeline systems beginning in December 2011. Federal policy and public-private plans establish roles and responsibilities for the protection of critical infrastructure, including pipelines. These include Presidential Policy Directive 21 (PPD-21), the NIPP, and Executive Order 13636. PPD-21, issued in February 2013, reflects an all- hazards approach to protecting critical infrastructure, including natural disasters, terrorism, and cyber incidents. The directive also identifies the 16 critical infrastructure sectors and assigns roles and responsibilities for each critical infrastructure sector among nine designated federal sector-specific agencies. While PPD-21 identified the critical infrastructure sectors and assigned responsibility for each sector’s sector-specific agency, the NIPP outlines critical infrastructure stakeholder roles and responsibilities regarding critical security and resilience. It describes a voluntary partnership model as the primary means of coordinating government and private sector efforts to protect critical infrastructure. As part of the partnership structure, the designated sector-specific agencies serve as the lead coordinators for security programs of their respective sector. As sector-specific agencies, federal departments or agencies lead, facilitate, or support the security and resilience programs and associated activities of their designated critical infrastructure sector. For example, DHS and DOT are both designated as sector-specific agencies for the transportation systems sector, which includes pipelines. Each sector also has a government coordinating council, consisting of representatives from various levels of government, and many have a sector coordinating council (SCC) consisting of owner-operators of these critical assets or members of their respective trade associations. For example, the Transportation Government Coordinating Council has been established, and the Pipeline Modal SCC has been established to represent pipeline operators. The NIPP also outlines a risk management framework for critical infrastructure protection. As shown in Figure 3, the NIPP uses a risk management framework as a planning methodology intended to inform how decision makers take actions to manage risk. The risk management framework calls for public and private critical infrastructure partners to conduct risk assessments to understand the most likely and severe incidents that could affect their operations and communities, and use this information to support planning and resource allocation. According to DHS, the risk management framework is influenced by the nature and magnitude of a threat, the vulnerabilities to that threat, and the consequences that could result, as shown in Figure 4. Federal policy has encouraged voluntary information-sharing mechanisms between the federal government and critical infrastructure owners and operators. For example, Information Sharing and Analysis Centers (ISAC) are formed by critical infrastructure owners and operators to gather, analyze, appropriately sanitize, and disseminate intelligence and information related to critical infrastructure. They typically collect, analyze and disseminate actionable threat information to their members and provide members with tools to mitigate risks and enhance resiliency. ISACs in which pipeline operators may participate have been formed including the Oil and Natural Gas ISAC, Downstream Natural Gas ISAC, and Electricity ISAC. Finally, in February 2013, the president issued Executive Order 13636, Improving Critical Infrastructure Cybersecurity, which cited repeated cyber intrusions into critical infrastructure as demonstrating the need for improved cybersecurity. Executive Order 13636 outlined actions for improving critical infrastructure cybersecurity, including direction for the National Institute of Standards and Technology (NIST) to lead the development of a voluntary risk-based cybersecurity framework that would comprise a set of industry standards and best practices to help organizations manage cybersecurity risks. NIST issued the framework in 2014 and updated it in April 2018. The order also addressed the need to improve cybersecurity information sharing and collaboratively develop risk-based standards and stated that U.S. policy was to increase the volume, timeliness, and quality of cyber threat information shared with private sector entities so that these entities may better protect and defend themselves against cyber threats. Protecting the nation’s pipeline systems is a responsibility shared by both the federal government and private industry. As a result, several federal departments, agencies, and the private sector have significant roles in pipeline physical and cyber-related security. These entities include the following: Transportation Security Administration (TSA). TSA, within DHS, has primary oversight responsibility for the physical security and cybersecurity of transmission and distribution pipeline systems. Within TSA, the Security Policy and Industry Engagement’s Pipeline Security Branch is charged with overseeing its pipeline security program. Pursuant to its authority, TSA’s Pipeline Security Branch first issued its voluntary Pipeline Security Guidelines in 2011, and released revised guidelines in March 2018. In accordance with the 9/11 Commission Act, TSA’s Pipeline Security Branch identifies the top 100 critical pipeline systems in the nation. To do so, it uses system annual throughput, which is based on the amount of hazardous liquid or natural gas product transported through a pipeline in 1 year (i.e., annual throughput). TSA also ranks the relative risk among the top 100 critical pipeline systems, discussed later in the report. Additionally, TSA’s Pipeline Security Branch is responsible for conducting voluntary Corporate Security Reviews (CSR) and Critical Facility Security Reviews (CFSR), which assess the extent to which the 100 most critical pipeline systems are following the intent of TSA’s Pipeline Security Guidelines. See figure 5 below for an overview of the CSR and CFSR processes. In addition, TSA Intelligence and Analysis is responsible for collecting and analyzing threat information related to the transportation network, and sharing relevant threat information to pipeline stakeholders. National Cybersecurity and Communications Integration Center (NCCIC). Within DHS, NCCIC assists critical infrastructure owners in addressing cyber incidents and attacks, including those targeting industrial control systems. The NCCIC’s mission is to reduce the likelihood and severity of incidents that may significantly compromise the security and resilience of the nation’s critical information technology and communications networks. NCCIC’s role is to serve as the federal civilian interface for sharing information related to cybersecurity risks, incidents, analysis, and warnings with federal and nonfederal entities, and to provide shared situational awareness to enable real-time actions to address cybersecurity risks and incidents to federal and nonfederal entities. Pipeline and Hazardous Materials Safety Administration (PHMSA). PHMSA, within DOT, is responsible for regulating the safety of hazardous materials transportation and the safety of pipeline systems, some aspects of which can be related to pipeline security. In 2004, PHMSA and TSA entered into a memorandum of understanding regarding their respective roles in all modes of transportation. In 2006, they signed an annex to the memorandum of understanding that further delineates lines of authority and responsibility between TSA and PHMSA on pipeline and hazardous materials transportation security. The annex identifies TSA as the lead federal entity for transportation security, including hazardous materials and pipeline security, and PHMSA as responsible for administering a national program of safety in natural gas and hazardous liquid pipeline transportation, including identifying pipeline safety concerns and developing uniform safety standards. Department of Energy (DOE). DOE is responsible for protecting electric power, oil, and natural gas delivery infrastructure and, in December 2015, was identified in statute as the sector-specific agency for cybersecurity for the energy sector. The Office of Cybersecurity, Energy Security, and Emergency Response is the lead for DOE’s cybersecurity efforts. In addition, DOE operates the National SCADA Test Bed Program, a partnership with Idaho National Laboratory, Sandia National Laboratories, and other national laboratories which addresses control system security challenges in the energy sector. Among its key functions, the program performs control systems testing, research, and development; control systems requirements development; and industry outreach. Federal Energy Regulatory Commission (FERC). FERC regulates the U.S. bulk electric power system, which is increasingly powered by natural gas pipeline systems. FERC has regulatory authority over interstate natural gas pipelines under the Natural Gas Act. However, its role is limited to natural gas pipeline siting and rate regulation. The North American Electric Reliability Corporation is the federally designated U.S. Electric Reliability Organization, and is overseen by FERC. The North American Electric Reliability Corporation, with approval from FERC, has developed mandatory critical infrastructure protection standards for protecting electric utility–critical and cyber-critical assets. Private sector. Although TSA has primary federal responsibility for overseeing interstate pipeline security, private sector pipeline operators are responsible for implementing asset-specific protective security measures. As we previously reported, operators have increased their attention on security by incorporating security practices and programs into their overall business operations. Pipeline operators’ interests and concerns are primarily represented by five major trade associations with ties to the pipeline industry—the Interstate Natural Gas Association of America (INGAA), American Gas Association (AGA), American Public Gas Association, American Petroleum Institute (API), and Association of Oil Pipe Lines. According to TSA officials, pipeline operators, and association representatives, these associations have worked closely with the federal government on a variety of pipeline security-related issues, including collaborating on TSA’s voluntary standards and information sharing. All of the pipeline operators and pipeline association representatives we interviewed reported receiving security information from federal and nonfederal entities. Pipeline operators also reported providing security- related information to federal agencies, including TSA, as incidents occur. Multiple federal entities exchange alerts of physical and cybersecurity incidents and other risk-related information with critical infrastructure partners, including pipeline operators. For example, DHS components including TSA’s Intelligence and Analysis and NCCIC share security- related information on physical and cyber threats and incidents with sector stakeholders. Specifically, Intelligence and Analysis provides quarterly intelligence briefings to pipeline operators. NCCIC also issues indicator bulletins, which can contain information related to cyber threat indicators, defensive measures, and cybersecurity risks and incidents. In addition, TSA and other federal entities have coordinated to address specific pipeline-related security incidents. For example, TSA officials coordinated with DOT, DOE, the Department of Justice, and FERC through the Oil and Natural Gas subsector SCC to address ongoing incidents of vandalism and sabotage of critical pipeline assets by environmental activists in 2016. In July 2017, according to DOT officials, PHMSA and TSA collaborated on a web-based portal to facilitate sharing sensitive but unclassified incident information among federal agencies with pipeline-related responsibilities. See table 1 for the key federal information sharing entities and programs that exchange security-related or incident information with critical infrastructure stakeholders, including the pipeline sector. Pipeline operators also share security-related information with TSA and the NCCIC. In its Pipeline Security Guidelines, TSA requests that pipeline operators report by telephone or email to its Transportation Security Operations Center (TSOC) any physical security incidents that are indicative of a deliberate attempt to disrupt pipeline operations or activities that could be considered precursors to such an attempt. TSA’s Pipeline Security Guidelines also request that operators report any actual or suspected cyber attacks that could impact pipeline industrial control systems or other information technology-based systems to the NCCIC. According to the TSOC’s operating procedures, if a reported incident meets certain criteria, such as the incident was intended to or resulted in damage or requires a general evacuation of a facility, the TSOC watch officer is then to contact Office of Security and Industry Engagement officials. According to TSA officials, the TSOC does not conduct investigations of the specific security incidents that pipeline operators report. However, TSOC staff do analyze the incident information they receive for national trends and common threats. TSA officials stated that they share their observations with pipeline operators and other critical infrastructure asset owners during monthly and quarterly conference calls that TSA holds with pipeline operators. All the pipeline operators and association representatives we interviewed identified other nonfederal information sharing entities, including ISACs, fusion centers, industry associations, and SCCs, which provide forums for exchanging information about physical and cyber incidents throughout the pipeline sector. See table 2 for nonfederal information sharing entities identified as available to pipeline operators. Operators and TSA officials reported that the current backlog in granting security clearances for some key pipeline operator employees was a significant factor affecting information sharing between TSA and pipeline operators. TSA officials acknowledged that some pipeline operators have had difficulty obtaining security clearances for key employees due to ongoing backlogs in processing requests by the Office of Personnel Management National Background Investigation Bureau, and that TSA’s ability to share timely information with operators whose staff do not have a clearance may be hindered. Three of the 10 pipeline operators we interviewed identified receiving timely classified security information as a specific challenge due, in part, to difficulties staff have had obtaining security clearances. Further, 7 of the 10 pipeline operators that we interviewed reported experiencing delays in obtaining a security clearance or were aware of others who had experienced this issue. However, according to three operators we interviewed, TSA was helpful in facilitating approval of security clearances for the operators’ personnel to access classified information when necessary. This security clearance challenge is not faced by pipeline operators alone. In January 2018, we designated the backlog of investigations for the clearance process and the government-wide personnel security clearance process as a high-risk area. We will continue to monitor agencies’ progress in reducing the backlog and improving the security clearance process. Pipeline operators that we interviewed reported using a range of guidelines and standards to address their physical and cybersecurity risks, and all of them reported implementing TSA’s voluntary Pipeline Security Guidelines that were applicable to their operations. TSA revised and issued its Pipeline Security Guidelines in March 2018, but the revised guidelines lack a defined process to consider updates to supporting guidance such as to the NIST Framework for Improving Critical Infrastructure Cybersecurity (Cybersecurity Framework). Furthermore, TSA has not clearly defined the terms within the criteria that pipeline operators are to use to determine the criticality of their facilities. Pipeline operators that we interviewed reported using a range of guidelines and standards to address their physical and cybersecurity risks. For example, all 10 of the pipeline operators we interviewed stated they had implemented the voluntary 2011 TSA Pipeline Security Guidelines the operators determined to be applicable to their operations. The guidelines provide TSA’s recommendations for pipeline industry security practices such as establishing a corporate security program and identifying critical facilities among others (see sidebar). Five of the 10 pipeline operators we interviewed characterized the guidelines as generally or somewhat effective in helping to secure their operations, 1 was neutral on their effectiveness, and 4 did not provide an assessment of the guidelines’ effectiveness. However, one operator pointed out that they had not adopted the guidelines’ recommended interval of 36 months or less for conducting security vulnerability assessments due to staffing limitations. Also, another pipeline operator noted that they were working to implement the guidelines in the operations of a newly acquired asset that they determined was not using the guidelines in the same manner as their company. All of the pipeline operators we interviewed reported using other guidelines or standards to address pipeline systems’ security risks. For example, pipeline operators reported using and industry association representatives reported that their members use INGAA’s Control Systems Cyber Security Guidelines for the Natural Gas Pipeline Industry, API’s Pipeline SCADA Security standard, and the NIST Cybersecurity Framework as sources of cybersecurity standards, guidelines, and practices that may be scaled and applied to address a pipeline operator’s cybersecurity risks. Further, pipeline operators are required to adhere to regulations related to pipeline safety and, depending upon their assets, operations, and location, may be required to adhere to regulations for electrical utilities, chemical storage facilities, and locations near waterways. For example, all pipeline operators must adhere to DOT’s PHMSA safety regulations. In addition, pipeline operators whose systems include chemical facilities may be required to comply with DHS’s Chemical Facility Anti-Terrorism Standards (CFATS). Pipeline operators whose systems include a terminal located on a U.S. port may be required to comply with Maritime Transportation Security Act regulations. For a listing of federal and industry guidelines identified as applicable to security by the pipeline operators, see appendix I. TSA’s Pipeline Security Branch issued its revised Pipeline Security Guidelines in March 2018, but TSA has not established a documented process to ensure that revisions occur and fully capture updates to supporting standards and guidance. The guidelines were revised to, among other things, reflect the dynamic threat environment and to incorporate cybersecurity principles and practices from the NIST Cybersecurity Framework, which were initially issued in February 2014. To revise the guidelines and incorporate feedback, according to Pipeline Security Branch officials, they incorporated outcomes from pipeline modal threat assessments and best practices from security reviews, and collaborated with pipeline sector stakeholders—including industry associations and other federal agencies with a role in pipeline security. Officials from the industry associations we interviewed confirmed that they provided input to the revised pipeline guidelines, including meeting with and consolidating comments from member pipeline operators. See figure 6 for a timeline of events pertinent to federal pipeline security guidelines. TSA’s Pipeline Security Smart Practice Observations for pipeline operators states that security plans should have a documented process to include security plan reviews and updates on a periodic and an as- needed basis. Standards for Internal Control in the Federal Government states that periodic review of policies, procedures, and related control activities should occur to determine their continued relevance and effectiveness in achieving identified objectives or addressing related risks. The NIPP and NIST also emphasize the need to provide updates on incident response guidance and security procedures, respectively. Moreover, other pipeline industry guidance cited by TSA’s guidelines also has a prescribed interval for review and revision. For example, API reviews its standards at least every 5 years. However, TSA has not instituted a documented process to consider the need to update the Pipeline Security Guidelines on a regular basis. Pipeline Security Branch officials acknowledged the value of having a defined process for reviewing and, if necessary, revising TSA’s Pipeline Security Guidelines at regular defined intervals to ensure it includes, among other things, newly identified best practices and updated industry guidance that are relevant to pipeline operators, such as the elements of the latest version of NIST’s Cybersecurity Framework. For example, TSA’s revisions to its guidelines incorporated some, but not all of the elements of the NIST Cybersecurity Framework version 1. Specifically, to improve incident response, the NIST framework recommends implementing an incident response analysis and feedback function to a security program. However, TSA’s Pipeline Security Guidelines do not include similar steps for pipelines operators to include in their pipeline security programs. Further, because NIST released version 1.1 of the Cybersecurity Framework in April 2018, the guidelines that TSA released in March 2018 do not incorporate cybersecurity elements that NIST added to the latest Cybersecurity Framework such as the Supply Chain Risk Management category. Pipeline Security Branch officials said that they have not instituted a review process on a regular basis because they intended to review and revise TSA’s guidelines on an as-needed basis in response to updated supporting guidance, but could provide no timeline for doing so. Without a documented process defining how frequently Pipeline Security Branch staff are to review and revise its guidelines, TSA cannot ensure that its guidelines reflect the latest known standards and best practices for physical and cybersecurity, or address the persistent and dynamic security threat environment currently facing the nation’s pipeline system. Under TSA’s Pipeline Security Guidelines, pipeline operators are to self- identify the critical facilities within their system and report their critical facilities to TSA. TSA’s Pipeline Security Branch conducts CFSRs at the critical facilities that pipeline operators have identified. However, our analysis of TSA’s data found that at least 34 of the top 100 critical pipeline systems deemed highest risk indicated that they had no critical facilities. Accordingly, TSA would not conduct a CFSR at any of these systems’ facilities because their operators identified none of them as critical. The fact that pipeline operators of about one third of the highest risk systems identified no critical facilities may be due, in part, to the Pipeline Security Branch not clearly defining the criteria outlined in the Pipeline Security Guidelines that pipeline operators are to use to determine the criticality of their facilities. Three of the 10 operators we interviewed stated that some companies reported to TSA that they had no critical facilities, and may possibly be taking advantage of the guidelines’ lack of clarity. Accordingly, operators that report no critical facilities would avoid TSA’s reviews of their facilities. service or deliverability resulting in a state or local government's inability to provide essential public services and emergency response for an extended period of time; Significantly damage or destroy national intended use of major rivers, lakes, or waterways (e.g., public drinking water for large populations or disruption of major commerce or public transportation routes); service or deliverability to a significant number of customers or individuals for an extended period of time; operations for an extended period of time (i.e., business critical facilities). Our review of the eight criteria included in TSA’s Pipeline Security Guidelines (see sidebar) found that no additional examples or clarification are provided to help operators determine criticality. Although we previously noted that 5 of the 10 operators we interviewed generally found TSA’s Guidelines as a whole helpful in addressing pipeline security, more than half of the operators we interviewed identified TSA’s criticality criteria as a specific area for improvement. Specifically, 3 of the 10 pipeline operators that we interviewed stated that TSA had not clearly defined certain terms within the criteria, and 3 additional operators of the 10 reported that additional consultation with TSA was necessary to appropriately apply the criteria and determine their facilities’ criticality. For example, 2 operators told us that individual operators may interpret TSA’s criterion, “cause mass casualties or significant health effect,” differently. One of these operators that we interviewed stated that this criterion could be interpreted either as a specific number of people affected or a sufficient volume to overwhelm a local health department, which could vary depending on the locality. Another operator reported that because TSA’s criteria were not clear, they created their own criteria which helped the operator identify two additional critical facilities. Pipeline Security Branch officials acknowledged there are companies that report having no critical facilities in their pipeline systems. According to Pipeline Security Branch officials, pipeline operators are in the best position to determine which of their facilities are critical, and the companies that have determined that their pipeline systems have no critical facilities also have reported sufficient redundancies to make none of their facilities critical to the continuity of their operations. According to these officials, they have had extensive discussions with pipeline company officials to assess the validity of their criticality determinations, and have closely questioned companies to ensure they have properly applied TSA’s criteria. However, according to TSA’s Pipeline Security Guidelines, operators should use a consistent set of criteria for determining the criticality of their facilities. In addition, Standards for Internal Control in the Federal Government states that management should define objectives clearly to enable the identification of risks. To achieve this, management generally defines objectives in specific and measurable terms and ensures the terms are fully and clearly set forth so they can be easily understood. Pipeline Security Branch officials acknowledged that the criticality definitions in the Pipeline Security Guidelines could be clarified to be more specific. Additionally, an industry association representative reported that the association, in consultation with TSA, has been developing supplementary guidance for its members to clarify certain terms in TSA’s critical facility criteria. As of October 2018 this guidance is still under review at the association and has not been made available to the association’s members. Pipeline Security Branch officials confirmed they worked with the industry association on its supplementary guidance, but also acknowledged that the supplementary guidance may only be distributed to the association’s membership. Without clearly defined criteria for determining pipeline facilities’ criticality, TSA cannot ensure that pipeline operators are applying its guidance uniformly. Further, because TSA selects the pipeline facilities on which to conduct CFSRs based on operators’ determinations, TSA cannot fully ensure that all of the critical facilities across the pipeline sector have been identified using the same criteria, or that their vulnerabilities have been identified and addressed. TSA’s Intelligence and Analysis identifies security risks to pipeline systems through various assessments. Additionally, TSA’s Pipeline Security Branch conducts security reviews to assess pipeline operators’ implementation of TSA’s Pipeline Security Guidelines, but gaps in staffing and lack of a workforce plan may affect its ability to carry out effective reviews. The Pipeline Security Branch also developed a pipeline risk assessment to rank relative risk of the top 100 critical pipeline systems and to prioritize its security reviews of pipeline companies, but shortfalls in its calculations of threat, vulnerability, and consequence may limit its ability to accurately identify pipeline systems with the highest risk. Finally, the pipeline risk assessment has not been peer reviewed to validate the assessment’s data and methodology, which we previously reported as a best practice in risk management. TSA’s Intelligence and Analysis produces assessments related to pipeline security risks, including Pipeline Modal and Cyber Modal Threat Assessments and the Transportation Sector Security Risk Assessment. The Pipeline and Cyber Modal Threat Assessments are issued on a semiannual basis; TSA Intelligence and Analysis may also issue additional situation-based products on emerging threats. The Pipeline Modal and Cyber Modal Threat Assessments evaluate, respectively, physical and cyber threats to pipelines. The pipeline modal threat assessment evaluates terrorist threats to hazardous liquid and natural gas pipelines, and the cyber modal threat assessment evaluates cyber threats to transportation, including pipelines. Both assessments specifically analyze the primary threat actors, their capabilities, and activities—including attacks occurring internationally—as well as other characteristics of threat. The Transportation Sector Security Risk Assessment assesses threat, vulnerability, and consequence for various attack scenarios across the five transportation modes for which TSA is responsible. The scenarios define a type of threat actor—including homegrown violent extremists and transnational extremists, such as al Qaeda and its affiliates—a target, and an attack mode. For example, a scenario might assess the risk of attacks using varying sizes of improvised explosive devices on pipeline system assets. As part of the assessment process, TSA engages with subject matter experts from TSA and industry stakeholder representatives to compile vulnerabilities for each mode, and TSA analyzes both direct and indirect consequences of the various attack scenarios. According to Pipeline Security Branch officials, the assessments produced by TSA’s Intelligence and Analysis provide key information to inform the pipeline security program’s efforts. According to TSA officials, TSA conducts pipeline security reviews— Corporate Security Reviews (CSRs) and Critical Facility Security Reviews (CFSRs)—to assess pipeline vulnerabilities and industry implementation of TSA’s Pipeline Security Guidelines. However, as shown by Figure 7 below, the number of CSRs and CFSRs completed by TSA has varied during the last five fiscal years, ranging from zero CSRs conducted in fiscal year 2014 to 23 CSRs conducted in fiscal year 2018, as of July 31, 2018. TSA officials reported that staffing limitations have prevented TSA from conducting more reviews. As shown in table 3, TSA Pipeline Security Branch staffing levels (excluding contractor support) have varied significantly over the past 9 years ranging from 14 full-time equivalents (FTEs) in fiscal years 2012 and 2013 to one FTE in fiscal year 2014. They stated that, while contractor support has assisted with conducting CFSRs, there were no contractor personnel providing CSR support from fiscal years 2010 through 2017, but that has now increased to two personnel in fiscal year 2018. TSA prioritizes reviewing and collecting information on the nation’s top 100 critical pipeline systems. According to TSA officials, they would need to conduct 46 CSRs in order to review the top 100 critical pipeline systems. In July 2018, TSA officials stated that TSA’s current target was to assess each pipeline company every 2 to 3 years; this would equate to about 15 to 23 CSRs per year. TSA officials stated that they expect to complete 20 CSRs and 60 CFSRs per fiscal year with Pipeline Security Branch employees and contract support, and have completed 23 CSRs through July 2018 for fiscal year 2018. Given the ever-increasing cybersecurity risks to pipeline systems, ensuring that the Pipeline Security Branch has the required cybersecurity skills to effectively evaluate pipeline systems’ cybersecurity is essential. Pipeline operators we interviewed emphasized the importance of cybersecurity skills among TSA staff. Specifically, 6 of the 10 pipeline operators and 3 of the 5 industry representatives we interviewed reported that the level of cybersecurity expertise among TSA staff and contractors may challenge the Pipeline Security Branch’s ability to fully assess the cybersecurity portions of its security reviews. TSA officials stated that Security Policy and Industry Engagement staff are working with DHS’s National Protection and Programs Directorate to help address cyber- related needs, including identifying specific cybersecurity skills and competencies required for the pipeline security program. The officials were uncertain, however, whether TSA would use contractor support or support from the National Protection and Programs Directorate to provide identified skills and competencies. TSA officials also stated that Security Policy and Industry Engagement staff work with TSA’s human resource professionals to identify critical skills and competencies needed for Pipeline Security Branch personnel, and helps its workforce maintain professional expertise by providing training and education for any identified skill or competency gaps. Our previous work has identified principles that a strategic workforce planning process should follow including developing strategies tailored to address gaps in number, deployment, and alignment of human capital approaches for enabling and sustaining the contributions of all critical skills and competencies. Workforce planning efforts, linked to an agency’s strategic goals and objectives, can enable it to remain aware of and be prepared for its needs, including the size of its workforce, its deployment across the organization, and the knowledge, skills, and abilities needed for it to pursue its mission. Agencies should consider how hiring, training, staff development, performance management, and other human capital strategies can be aligned to eliminate gaps and improve the long-term contribution of skills and competencies identified as important for mission success. TSA has not established a workforce plan for its Security Policy and Industry Engagement or its Pipeline Security Branch that identifies staffing needs and skill sets such as the required level of cybersecurity expertise among TSA staff and contractors. When asked for TSA strategic workforce planning documents used to inform staffing allocations related to the pipeline security program, TSA officials acknowledged they do not have a strategic workforce plan. Rather, according to these officials, TSA determines agency-level staffing allocations through the Planning, Programming, Budgeting and Execution process, which is used to decide policy, strategy, and the development of personnel and capabilities to accomplish anticipated missions. According to TSA officials, when they use this process they look at existing resources and then set priorities based on the TSA Administrator’s needs. However, a strategic workforce plan allows an agency to identify and prepare for its needs, such as the size of its workforce, its deployment across the organization, and the knowledge, skills, and abilities needed to pursue its mission. TSA officials stated that the agency has a detailed allocation plan for strategically aligning resources to screen passengers at TSA-regulated airports, but not for the entire agency. By establishing a strategic workforce plan, TSA can help ensure it has identified the knowledge, skills, and abilities that the future workforce of TSA’s Pipeline Security Branch may need in order to meet its mission of reducing pipeline systems’ vulnerabilities to physical and cybersecurity risks, especially in a dynamic and evolving threat environment. Further, as greater emphasis is placed on cybersecurity, determining the long- term staffing needs of the Pipeline Security Branch will be essential. Furthermore, a workforce plan could enable TSA to determine the number of personnel it needs to meet its stated goals for conducting CSRs and CFSRs. After TSA identifies the top 100 critical pipeline systems based on throughput, the Pipeline Security Branch uses the Pipeline Relative Risk Ranking Tool (risk assessment), which it developed in 2007, to assess various security risks of those systems. We previously reported, in 2010, that the Pipeline Security Branch was the first of TSA’s surface transportation modes to develop a risk assessment model that combined all three components of risk—threat, vulnerability, and consequence—to generate a risk score. The risk assessment generates a risk score for each of the 100 most critical pipeline systems and ranks them according to risk. The risk assessment calculates threat, vulnerability, and consequence for each pipeline system on variables such as the amount of throughput in the pipeline system and the number critical facilities. The risk assessment combines data collected from pipeline operators, as well as other federal agencies, such as the Departments of Transportation and Defense, to generate the risk score. However, the last time the Pipeline Security Branch calculated relative risk among the top 100 critical pipeline systems using the risk assessment was in 2014. Pipeline Security Branch officials told us that they use the pipeline risk assessment to rank relative risk of the top 100 critical pipeline systems, and the standard operating procedures for conducting CSRs state the results of the risk ranking are the primary factor considered when prioritizing corporate security reviews of pipeline companies. According to Pipeline Security Branch officials, the risk assessment has not changed since 2014 because the Pipeline Security Branch is still conducting CSRs based on the 2014 ranking of pipeline systems. As outlined in table 4 below, we identified several factors that likely limit the usefulness of the current risk assessment in calculating threat, vulnerability, and consequence to allow the Pipeline Security Branch to effectively prioritize reviews of pipeline systems. For example, because the risk assessment has not changed since 2014, information on threat may be outdated. Additionally, sources of data and underlying assumption and judgments regarding certain threat and vulnerability inputs to the assessment are not fully documented. For example, threats to cybersecurity are not specifically accounted for in the description of the risk assessment methodology, making it unclear if cybersecurity is part of the assessment’s threat factor. Further, the risk assessment does not include information that is consistent with the NIPP and other DHS priorities for critical infrastructure risk mitigation, such as information on natural hazards and the ability to measure risk reduction (feedback data). According to Pipeline Security Branch officials, the risk ranking assessment is not intended to be a fully developed risk model detailing all pipeline factors influencing risk. Rather, officials said they are primarily interested in assessing risk data that impacts security. However, because TSA’s Pipeline Security Program is designed to enhance the security preparedness of the pipeline systems, incorporating additional factors that enhance security into their risk calculation would better align their efforts with PPD-21. For example, PPD-21 calls for agencies to integrate and analyze information to prioritize assets and manage risks to critical infrastructure, as well as anticipate interdependencies and cascading impacts. For a more detailed discussion of the shortfalls we identified, refer to appendix II. In addition to the shortfalls identified above, the risk assessment has not been peer reviewed since its conception in 2007. In our past work, we reported that independent, external peer reviews are a best practice in risk management and that independent expert review panels can provide objective reviews of complex issues. According to the National Research Council of the National Academies, external peer reviews should, among other things, address the structure of the assessment, the types and certainty of the data, and how the assessment is intended to be used. The National Research Council has also recommended that DHS improve its risk analyses for infrastructure protection by validating the assessments and submitting them to independent, external peer review. Other DHS components have implemented our prior recommendations to conduct peer reviews of their risk assessments. For example, in April 2013, we reported on DHS’s management of its Chemical Facility Anti- Terrorism Standards (CFATS) program and found that the approach used to assess risk did not consider all of the elements of consequence, threat, and vulnerability associated with a terrorist attack involving certain chemicals. The Infrastructure Security Compliance Division, which manages the CFATS program conducted a multiyear effort to improve their risk assessment methodology and included commissioning a peer review by the Homeland Security Studies and Analysis Institute, which resulted in multiple recommendations. As part of the implementation of some of the peer review’s recommendations, DHS conducted peer reviews and technical reviews with government organizations and facility owners and operators, and worked with Sandia National Laboratories to verify and validate the CFATS program’s revised risk assessment methodology, which was completed in January 2017. According to Pipeline Security Branch officials, they are considering updates to the risk assessment methodology including changes to the vulnerability and consequence factors. These officials said the risk assessment was previously reviewed within the past 18 months by industry experts and they consider input from several federal partners including DHS, DOT, and the Department of Defense. Officials also said they will consider input from industry experts and federal partners while working on updating the risk assessment. However, most of the proposed changes to the risk assessment methodology officials described are ones that have been deliberated since our last review in 2010. Therefore, an independent, external peer review would provide the opportunity for integration and analysis of additional outside expertise across the critical infrastructure community. While independent, external peer reviews cannot ensure the success of a risk assessment approach, they can increase the probability of success by improving the technical quality of projects and the credibility of the decision-making process. According to the National Research Council of the National Academies, independent, external peer reviews should include validation and verification to ensure that the structure of the risk assessment is both accurate and reliable. Thus, an independent, external peer review would provide better assurance that the Pipeline Security Branch can rank relative risk among pipeline systems using the most comprehensive and accurate threat, vulnerability, and consequence information. TSA has established performance measures, as well as databases to monitor pipeline security reviews and analyze their results. However, weaknesses in its performance measures and its efforts to record pipeline security review recommendations limit its ability to determine the extent that its pipeline security program has reduced pipeline sector risks. Furthermore, we identified data reliability issues in the information that TSA collects to track the status of pipeline security review recommendations, such as missing data, inconsistent data entry formats, and data entry errors. TSA has three sets of performance measures for its pipeline efforts: the Pipeline Security Plan in the 2018 Biennial National Strategy for Transportation Security (NSTS), a management measure in the DHS fiscal year 2019 congressional budget justification, and summary figures in their CSR and CFSR databases. As a result of our 2010 work, TSA established performance measures and linked them to Pipeline Security Plan goals within the Surface Security Plan of the 2018 NSTS. See table 5 below for the 2018 NSTS Pipeline Security Plan performance measures. As shown in table 6 below, DHS also included a management measure in its fiscal year 2019 congressional budget justification to track the annual number of completed pipeline security reviews. Finally, TSA Pipeline Security Branch officials said they use summary figures in the CFSR status database and the CSR goals and priorities database as performance measures. For example, these include the percentage of CFSR recommendations implemented and the average percentage compliance with the guidelines by fiscal year. We previously found that results-oriented organizations set performance goals to clearly define desired program outcomes and develop performance measures that are clearly linked to the performance goals. Performance measures should focus on whether a program has achieved measurable standards toward achieving program goals, and allow agencies to monitor and report program accomplishments on an ongoing basis. Our previous work on performance metrics identified 10 attributes of effective performance. Table 7 identifies each key attribute of effective performance measures along with its definition. We evaluated the current performance measures included in the 2018 NSTS, the DHS fiscal year 2019 congressional budget justification, the CSR goals and priorities database, and the CFSR status database related to TSA’s Pipeline Security Branch. We primarily focused on key attributes which could be applied to individual measures. These include clarity, linkage, measurable targets, objectivity, reliability, and baseline and trend data. Our prior work on performance measurement found that all performance measure attributes are not equal and failure to have a particular attribute does not necessarily indicate that there is a weakness in that area or that the measure is not useful; rather, it may indicate an opportunity for further refinement. Based on our evaluation, the TSA-identified measures do not possess attributes that we have identified as being key to successful performance measures. As a result, TSA cannot fully determine the extent to which the Pipeline Security Branch has achieved desired outcomes, including the effectiveness of its efforts to reduce risks to pipelines. Specifically, many of TSA’s measures cover agency goals and mission, but they generally lack clarity and measurable targets, provide significantly overlapping information, and do not include baseline and trend data. Clarity. The pipeline-related measures in the 2018 NSTS are not clear because they do not describe the methodology used to calculate them, and the names and definitions are not clearly described. For example, NSTS goal 1 includes an objective to conduct training of employees responding to terrorist attacks. The desired outcome is to improve the capability of industry employees to respond and recover from terrorist attacks. However, the performance measure is the percentage of critical pipeline systems implementing the TSA Pipeline Security Guidelines. It is not clear if this measure is specific to the sections of the guidelines related to employee training or overall implementation of the guidelines. The CFSR status database measures include the percentage of recommendations implemented by topic, such as “Site Specific Security Measures,” “Signage,” or “Miscellaneous.” However, the database does not specifically define these topics or explain the methodology for calculating the measures. Unclear measures could be confusing and misleading to users. Core program activities. The pipeline-related measures in the 2018 NSTS cover some of the agency’s core program activities, such as conducting security exercises with the pipeline industry and providing intelligence and information products to the industry. However, the NSTS Pipeline Security Plan measures do not specifically include some core program activities, such as updating the TSA Pipeline Security Guidelines or the results of conducting CSRs and CFSRs in order to collect the information necessary for the existing performance measures. The CSR goals and priorities database and the CFSR status database include measures intended to track some of the results of pipeline security reviews, such as the average percentage compliance with the guidelines by fiscal year and the percentage of CFSR recommendations implemented. If core program activities are not covered, there may not be enough information available in those areas to managers and stakeholders. Limited overlap. The pipeline-related measures in the 2018 NSTS do not have limited overlap. As discussed previously, four of the five NSTS measures are based on the percentage of critical pipeline systems implementing TSA’s Pipeline Security Guidelines. The management measure is based on the number of complete pipeline security reviews. The CFSR status database measures are based on the percentage of recommendations implemented overall and by groups. Finally, the CSR goals and priorities database measures are based on the average compliance percentage of companies that had CSRs conducted in fiscal years 2016 and 2017. This is similar to four of the five NSTS measures. Significantly overlapping measures may lead to redundant, costly information that does not add value for TSA management. Linkage. The pipeline-related measures in the 2018 NSTS generally exhibited this key attribute. For example, all of the NSTS measures were arranged by agency strategic goals and risk-based priorities. However, the management measure in DHS’s fiscal year 2019 congressional budget justification and the CFSR status database measures did not specify the TSA goals and priorities to which they were aligned. If measures are not aligned with division and agency- wide goals and mission, the behaviors and incentives created by these measures do not support achieving those goals or mission. Measurable target. TSA’s measures generally did not include measurable targets in the form of a numerical goal and none of the NSTS measures had measurable targets. For example, the NSTS measure under the Security Planning priority, which tracks the percentage of critical pipeline systems implementing TSA’s Pipeline Security Guidelines, does not state what specific percentages would be considered an improvement in industry security plans. However, the management measure did include target numbers of pipeline security reviews by fiscal year. Both the CFSR status database measures and CSR goals and priorities database measures did not include measurable targets. Without measurable targets, TSA cannot tell if performance is meeting expectations. Objectivity. Because the pipeline-related measures in the 2018 NSTS, the CFSR status database, and the CSR goals and priorities database generally lack clarity and measurable targets, TSA cannot ensure its measures are free from bias or manipulation, and therefore, are not objective. If measures are not objective, the results of performance assessments may be systematically overstated or understated. Reliability. Because the pipeline-related measures in the 2018 NSTS, the CFSR status database, and the CSR goals and priorities database generally lack clarity, measurable targets, and baseline and trend data, it is not clear if TSA’s measures produce the same result under similar conditions; therefore, the pipeline-related measures are unreliable. If measures are not reliable, reported performance data may be inconsistent and add uncertainty. Baseline and trend data. TSA’s measures generally did not include baseline and trend data. For example, none of the NSTS measures included past results and compared them to measurable targets. TSA officials were unable to identify measures or goals to assess the extent to which pipeline operators have fully implemented the guidelines or increased pipeline security, but did say developing a feedback mechanism to measure progress in closing vulnerability gaps was important. However, the management measure did include the number of completed pipeline security reviews for each fiscal year from 2014 through 2017, as well as numerical goals. The CFSR status database includes information on CFSRs conducted from May 22, 2012, through June 29, 2017, but the measures are calculated for the entire time period rather than year-by-year. The CSR goals and priorities database measures include percentage compliance with the guidelines for CSRs conducted in fiscal years 2016 and 2017, as well as a combined measure. However, baseline and trend data are not tracked or reported in either database. Collecting, tracking, developing, and reporting baseline and trend data allows agencies to better evaluate progress being made and whether or not goals are being achieved. Pipeline Security Branch officials explained that in addition to the measures reported in the 2018 NSTS Pipeline Security Plan, they primarily rely on measures assessing CSR and CFSR implementation for assessing the value of its pipeline security program. TSA officials reported that they collect and analyze data and information collected from CSRs and CFSRs to, among other things, determine strengths and weaknesses at critical pipeline facilities, areas to target for risk reduction strategies, and pipeline industry implementation of the voluntary Pipeline Security Guidelines. For example, TSA officials reported that they analyzed information from approximately 734 CFSR recommendations that were made during fiscal years 2012 through 2016. They found that pipeline operators had made the strongest improvements in security training, public awareness outreach and law enforcement coordination, and site specific security measures. The most common areas in need of improvement were 24x7 monitoring, frequency of security vulnerability assessments, and proper signage. However, as described above, we found those measures also did not comport with key attributes for successful measures and we report below on reliability concerns for underlying data supporting those measures. In addition, while the Pipeline Security Branch may not rely on the measures included in the 2018 NSTS Pipeline Security Plan and the fiscal year 2019 congressional budget justification, they are important for reporting the status of pipeline security efforts to TSA as a whole and to external stakeholders such as Congress. Taking steps to ensure that the pipeline security program performance measures exhibit key attributes of successful performance measures could allow TSA to better assess the program’s effectiveness at reducing pipeline physical and cybersecurity risks. This could include steps such as modifying its suite of measures so they are clear, have measurable targets, and add baseline and trend data. Further examples include the following: Adding measurable targets consisting of numerical goals could allow TSA to better determine if the pipeline security program is meeting expectations. For example, measurable targets could be added to TSA’s existing measures by developing annual goals for the percentage of recommendations implemented to the CFSR status database and then reporting annual results. To make measures clearer, TSA could verify that each measure has a clearly stated name, definition, and methodology for how the measure is calculated. For example, the NSTS objective for security training mentioned above could have more specific language explaining how the measure is calculated and whether it applies to pipeline operators’ implementation of the training-related portions of the TSA Pipeline Security Guidelines or overall implementation. Finally, adding baseline and trend data could allow TSA to identify, monitor, and report changes in performance and help ensure that performance is viewed in context. For example, the NSTS measures, CFSR status database measures, and CSR goals and priorities database measures could have annual results from prior years. This could help TSA and external stakeholders evaluate the effectiveness of the pipeline security program and whether it is making progress toward its goals. According to TSA officials, the primary means for assessing the effectiveness of the agency’s efforts to reduce pipeline security risks is through conducting pipeline security reviews— Corporate Security Reviews (CSRs) and Critical Facility Security Reviews (CFSRs). However, TSA has not tracked the status of CSR recommendations for over 5 years and related security review data are not sufficiently reliable. When conducting CSRs and CFSRs, TSA staff makes recommendations to operators, if appropriate. For example, a CSR recommendation might include a suggestion to conduct annual security-related drills and exercises, and a CFSR recommendation might include a suggestion to install barbed wire on the main gate of a pipeline facility. In response to recommendations that we made in our 2010 report, TSA developed three databases to track CSR and CFSR recommendations and their implementation status by pipeline facility, system, operator, and product type. In addition, the agency recently developed a fourth database to collect and analyze information gathered from pipeline operators’ responses to CSR questions. TSA officials reported that they use this database to assess the extent that TSA’s pipeline security program has met NSTS goals and Pipeline Security Branch priorities. TSA officials stated that they use the CSR goals and priorities database for follow-up on recommendations, indications of improvement in pipeline security, and as an input into TSA performance goals and measures, including the performance measures for the 2018 NSTS Pipeline Security Plan. We found several problems with the databases that indicate that the pipeline security program data are not sufficiently reliable and do not provide quality information that is current, complete, and accurate. First, the CSR recommendations database only included information for reviews conducted from November 2010 through February 2013. TSA officials stated that the agency stopped capturing CSR recommendations and status information in 2014. A TSA official stated that one factor was that the pipeline staffing level was one FTE in fiscal year 2014. However, the Pipeline Security Branch did not resume entering CSR recommendation-related information when staffing levels rose to 6 FTEs in the following year and beyond. As a result, TSA is missing over 5 years of data for the recommendations it made to pipeline operators when conducting CSRs. The agency collected some information from CSRs conducted in fiscal years 2016 and 2017 in the separate CSR goals and priorities database. However, this database does not include all of the information that TSA collects when conducting CSRs. Specifically, the CSR goals and priorities database does not state which companies were reviewed, what specific recommendations were made, or the current status of those recommendations, and only records operators’ responses to 79 of the 222 CSR questions. Second, our review identified instances of missing data, inconsistent data entry formats, and data entry errors in the four databases. For example: The CSR recommendations database had missing data in all 13 of the included fields and a data entry error shifted 50 observations into the wrong fields, impacting both the Status Date and Completion Code fields. The CSR goals and priorities database had seven entries with inconsistent data formatting and five of those entries were not taken into account when calculating summary figures. The CFSR recommendations database had missing data in 3 of 9 fields. There was also inconsistent data entry formats in 3 fields. The CFSR status database had missing data in 7 of 29 fields and inconsistent data entry formats in 4 fields. Finally, TSA has not documented its data entry and verification procedures, such as in a data dictionary or user manual, and does not have electronic safeguards for out-of-range or inconsistent entries for any of the databases it uses to track the status of CSR or CFSR recommendations and analyze operator responses to the CSR. TSA Pipeline Security Branch officials told us that they had not documented data entry and verification procedures and did not have electronic safeguards. This was for two reasons. First, the officials stated that the databases are small and maintained in a commercial spreadsheet program that does not allow for electronic safeguards. However, based on our review of the databases, the spreadsheet program does allow for a variety of electronic safeguards. For example, entries can be restricted to only allow selections from a drop-down list or only allow dates to be entered. Second, only a small number of TSA employees enter information into these databases. TSA officials explained that typically one TSA employee is responsible for entering information from pipeline security reviews, and another individual, usually whoever conducted the review, is tasked to verify the accuracy of the data entered. As a result, according to the officials, any errors would be self-evident and caught during these TSA employees’ reviews. Our work has emphasized the importance of quality information for management to make informed decisions and evaluate agencies’ performance in achieving key objectives and addressing risks. The Standards for Internal Control in the Federal Government states that management should use quality information to achieve agency objectives, where “quality” means, among other characteristics, current, complete, and accurate. In addition, DHS’s Information Quality Guidelines state that all DHS component agencies should treat information quality as integral to every step of the development of information, including creation, collection, maintenance, and dissemination. The guidelines also state that agencies should substantiate the quality of the information disseminated through documentation or other appropriate means. Without current, complete, and accurate information, it is difficult for TSA to evaluate the performance of the pipeline security program. Until TSA monitors and records the status of these reviews’ recommendations, it will be hindered in its efforts to determine whether its recommendations are leading to significant reduction in risk. By entering information on CSR recommendations and monitoring and recording their status, developing written documentation of its data entry and verification procedures and electronic safeguards, and improving the quality of its pipeline security program data, TSA could better ensure it has the information necessary to effectively monitor pipeline operators’ progress in improving their security posture, and evaluate its pipeline security program’s effectiveness in reducing security risks to pipelines. A successful pipeline attack could have dire consequences on public health and safety, as well as the U.S. economy. Recent coordinated campaigns by environmental activists to disrupt pipeline operations, and the successful attempts by nation-state actors to infiltrate and obtain sensitive information from pipeline operators’ business and operating systems, demonstrate the dynamic and continuous threat to the security of our nation’s pipeline network. To help ensure the safety of our pipelines throughout the nation, it is important for TSA to address weaknesses in the management of its pipeline security program. TSA’s Pipeline Security Branch revised its security guidelines in March 2018 to, among other things, reflect the dynamic threat environment and incorporate NIST’s Cybersecurity Framework cybersecurity principles and practices. However, without a documented process defining how frequently TSA is to review and, if deemed necessary, revise its guidelines, TSA cannot ensure that its guidelines reflect the latest known standards and best practices for physical and cybersecurity, or address the persistent and dynamic security threat environment currently facing the nation’s pipeline system. Further, without clearly defined criteria for determining pipeline facilities’ criticality, TSA cannot ensure that pipeline operators are applying guidance uniformly and that all of the critical facilities across the pipeline sector have been identified; or that their vulnerabilities have been identified and addressed. TSA could improve its ability to conduct pipeline security reviews and the means that it uses to prioritize which pipeline systems to review based on their relative risk ranking. Establishing a strategic workforce plan could help TSA ensure that it has identified the necessary skills, competencies, and staffing allocations that the Pipeline Security Branch needs to carry out its responsibilities, including conducting security reviews of critical pipeline companies and facilities, as well as their cybersecurity posture. Better considering threat, vulnerability, and consequence elements in its risk assessment and incorporating an independent, external peer review in its process would provide more assurance that the Pipeline Security Branch ranks relative risk among pipeline systems using comprehensive and accurate data and methods. We are making 10 recommendations to TSA: The TSA Administrator should direct the Security Policy and Industry Engagement’s Surface Division to implement a documented process for reviewing, and if deemed necessary, for revising TSA’s Pipeline Security Guidelines at regular defined intervals. (Recommendation 1) The TSA Administrator should direct the Security Policy and Industry Engagement’s Surface Division to clarify TSA’s Pipeline Security Guidelines by defining key terms within its criteria for determining critical facilities. (Recommendation 2) The TSA Administrator should develop a strategic workforce plan for its Security Policy and Industry Engagement’s Surface Division, which could include determining the number of personnel necessary to meet the goals set for its Pipeline Security Branch, as well as the knowledge, skills, and abilities, including cybersecurity, that are needed to effectively conduct CSRs and CFSRs. (Recommendation 3) The TSA Administrator should direct the Security Policy and Industry Engagement’s Surface Division to update the Pipeline Relative Risk Ranking Tool to include up-to-date data to ensure it reflects industry conditions, including throughput and threat data. (Recommendation 4) The TSA Administrator should direct the Security Policy and Industry Engagement’s Surface Division to fully document the data sources, underlying assumptions and judgments that form the basis of the Pipeline Relative Risk Ranking Tool, including sources of uncertainty and any implications for interpreting the results from the assessment. (Recommendation 5) The TSA Administrator should direct the Security Policy and Industry Engagement’s Surface Division to identify or develop other data sources relevant to threat, vulnerability, and consequence consistent with the NIPP and DHS critical infrastructure risk mitigation priorities and incorporate that data into the Pipeline Relative Risk Ranking Tool to assess relative risk of critical pipeline systems, which could include data on prior attacks, natural hazards, feedback data on pipeline system performance, physical pipeline condition, and cross-sector interdependencies. (Recommendation 6) The TSA Administrator should direct the Security Policy and Industry Engagement’s Surface Division to take steps to coordinate an independent, external peer review of its Pipeline Relative Risk Ranking Tool, after the Pipeline Security Branch completes enhancements to its risk assessment approach. (Recommendation 7) The TSA Administrator should direct the Security Policy and Industry Engagement’s Surface Division to ensure that it has a suite of performance measures which exhibit key attributes of successful performance measures, including measurable targets, clarity, and baseline and trend data. (Recommendation 8) The TSA Administrator should direct the Security Policy and Industry Engagement’s Surface Division to take steps to enter information on CSR recommendations and monitor and record their status. (Recommendation 9) The TSA Administrator should direct the Security Policy and Industry Engagement’s Surface Division to improve the quality of its pipeline security program data by developing written documentation of its data entry and verification procedures, implementing standardized data entry formats, and correcting existing data entry errors. (Recommendation 10) We provided a draft of this report to DHS, DOE, DOT, and FERC. DHS provided written comments which are reproduced in appendix III. In its comments, DHS concurred with our recommendations and described actions planned to address them. DHS, DOE, DOT, FERC, also provided technical comments, which we incorporated as appropriate. We also provided draft excerpts of this product to the American Petroleum Institute (API), the Association of Oil Pipe Lines, the American Gas Association (AGA), the Interstate Natural Gas Association of America (INGAA), the American Public Gas Association, and the selected pipeline operators that we interviewed. For those who provided technical comments, we incorporated them as appropriate. With regard to our first recommendation, that TSA implement a documented process for reviewing, and if deemed necessary, for revising its Pipeline Security Guidelines at regular defined intervals, DHS stated that TSA will implement a documented process for reviewing and revising its Pipeline Security Guidelines at regular defined intervals, as appropriate. DHS estimated that this effort would be completed by March 31, 2019. This action, if fully implemented, should address the intent of the recommendation. With regard to our second recommendation, that TSA clarify its Pipeline Security Guidelines by defining key terms within its criteria for determining critical facilities, DHS stated that TSA will clarify its Pipeline Security Guidelines by defining key terms within its criteria for determining critical facilities. DHS estimated that this effort would be completed by May 31, 2019. This action, if fully implemented, should address the intent of the recommendation. With regard to our third recommendation, that TSA develop a strategic workforce plan for its Security Policy and Industry Engagement's Surface Division, DHS stated that TSA will develop a strategic workforce plan for the division, which includes determining the number of personnel necessary to meet the goals set for the Pipeline Security Branch, as well as the knowledge, skills, and abilities, including cybersecurity, that are needed to effectively conduct CSRs and CFSRs. DHS estimated that this effort would be completed by June 30, 2019. This action, if fully implemented, should address the intent of the recommendation. With regard to our fourth recommendation, that TSA update the Pipeline Relative Risk Ranking Tool to include up-to-date data in order to ensure it reflects industry conditions, including throughput and threat data, DHS stated that TSA will update the Pipeline Relative Risk Ranking Tool to include up-to-date data in order to ensure it reflects industry conditions, including throughput and threat data. DHS estimated that this effort would be completed by February 28, 2019. This action, if fully implemented, should address the intent of the recommendation. With regard to our fifth recommendation, that TSA fully document the data sources, underlying assumptions, and judgements that form the basis of the Pipeline Relative Risk Ranking Tool, including sources of uncertainty and any implications for interpreting the results from the assessment, DHS stated that TSA will fully document the data sources, underlying assumptions, and judgements that form the basis of the Pipeline Relative Risk Ranking Tool. According to DHS, this will include sources of uncertainty and any implications for interpreting the results from the assessment. DHS estimated that this effort would be completed by February 28, 2019. This action, if fully implemented, should address the intent of the recommendation. With regard to our sixth recommendation, that TSA identify or develop other data sources relevant to threat, vulnerability, and consequence consistent with the NIPP and DHS critical infrastructure risk mitigation priorities and incorporate that data into the Pipeline Relative Risk Ranking Tool to assess relative risk of critical pipeline systems, DHS stated that TSA will identify and/or develop other sources relevant to threat, vulnerability, and consequence consistent with the NIPP and DHS critical infrastructure risk mitigation priorities. DHS also stated that TSA will incorporate that data into the Pipeline Risk Ranking Tool to assess relative risk of critical pipeline systems, which could include data on prior attacks, natural hazards, feedback data on pipeline system performance, physical pipeline condition, and cross-sector interdependencies. DHS estimated that this effort would be completed by June 30, 2019. This action, if fully implemented, should address the intent of the recommendation. With regard to our seventh recommendation, that TSA take steps to coordinate an independent, external peer review of its Pipeline Relative Risk Ranking Tool, after the Pipeline Security Branch completes enhancements to its risk assessment approach, DHS stated that, after completing enhancements to its risk assessment approach, TSA will take steps to coordinate an independent, external peer review of its Pipeline Relative Risk Ranking Tool. DHS estimated that this effort would be completed by November 30, 2019. This action, if fully implemented, should address the intent of the recommendation. With regard to our eighth recommendation, that TSA ensure that the Security Policy and Industry Engagement's Surface Division has a suite of performance measures which exhibit key attributes of successful performance measures, including measurable targets, clarity, baseline, and trend data, DHS stated that TSA’s Surface Division’s Pipeline Section will develop both physical and cyber security performance measures, in consultation with pipeline stakeholders, to ensure that it has a suite of performance measures which exhibit key attributes of successful performance measures, including measurable targets, clarity, baseline, and trend data. DHS estimated that this effort would be completed by November 30, 2019. This action, if fully implemented, should address the intent of the recommendation. With regard to our ninth recommendation, that TSA take steps to enter information on CSR recommendations and monitor and record their status, DHS stated that TSA will enter information on CSR recommendations and monitor and record their status. DHS estimated that this effort would be completed by October 31, 2019. This action, if fully implemented, should address the intent of the recommendation. With regard to our tenth recommendation, that TSA take steps to improve the quality of its pipeline security program data by developing written documentation of its data entry and verification procedures, implementing standardized data entry formats, and correcting existing data entry errors, DHS stated that TSA will develop written documentation of its data entry and verification procedures, implementing standardized data entry formats, and correcting existing data entry errors. DHS estimated that this effort would be completed by July 31, 2019. This action, if fully implemented, should address the intent of the recommendation. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until one day from the report date. At that time, we will send copies to the appropriate congressional committees; the Secretaries of Energy, Homeland Security, and Transportation; the Executive Director of the Federal Energy Regulatory Committee; and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact Chris Currie at (404) 679-1875 or curriec@gao.gov, and Nick Marinos at (202) 512-9342 or marinosn@gao.gov. Key contributors to this report are listed in appendix IV. This appendix lists security guidance and guidance-related tools that the pipeline operators and industry association officials we interviewed identified as adopted or available in order to secure their physical and cyber operations. This list should not be considered to include all physical and cybersecurity guidance that may be available or used by all pipeline operators nor do all operators use all guidance listed. The Transportation Security Administration’s (TSA) Pipeline Security Branch developed the Pipeline Relative Risk Ranking Tool (risk assessment) in 2007. The risk assessment calculates threat, vulnerability, and consequence on variables such as the amount of throughput in the pipeline system (consequence input). Pipeline Security Branch officials told us that they use the pipeline risk assessment to rank relative risk of the top 100 critical pipeline systems, and the standard operating procedures for conducting Corporate Security Reviews (CSR) state the results of the risk ranking are the primary factor considered when prioritizing CSRs of pipeline companies. However, we identified several factors that likely limit the usefulness of the current assessment in calculating threat, vulnerability, and consequence to allow the Pipeline Security Branch to effectively prioritize reviews of pipeline systems. For example, because the risk assessment has not changed since 2014, information on threat may be outdated. Additionally, sources of data and underlying assumption and judgments regarding certain threat and vulnerability inputs to the assessment are not fully documented. For example, threats to cybersecurity are not specifically accounted for in the description of the risk assessment methodology, making it unclear if cybersecurity is part of the assessment’s threat factor. Further, the risk assessment does not include information that is consistent with the National Infrastructure Protection Plan (NIPP) and other Department of Homeland Security (DHS) priorities for critical infrastructure risk mitigation, such as information on natural hazards and the ability to measure risk reduction (feedback data). According to Pipeline Security Branch officials, the risk ranking assessment is not intended to be a fully developed risk model detailing all pipeline factors influencing risk. Rather, officials said they are primarily interested in assessing risk data that impacts security. However, because TSA’s Pipeline Security Program is designed to enhance the security preparedness of the pipeline systems, incorporating additional factors that enhance security into their risk calculation of the most critical pipeline systems would better align their efforts with Presidential Policy Directive 21 (PPD-21). For example, PPD-21 calls for agencies to integrate and analyze information to prioritize assets and manage risks to critical infrastructure, as well as anticipate interdependencies and cascading impacts. Below we present the various shortfalls in the risk assessment—outdated data, limited description of sources and methodology, and opportunities to better align with the NIPP and other DHS priorities for critical infrastructure risk mitigation—in the context of the components that comprise a risk assessment: threat, vulnerability, and consequence. Whereas in 2010 we made recommendations to improve the consequence component in the pipeline relative risk ranking tool, we have currently identified shortfalls that cut across all risk components: threat, vulnerability, and consequence. We identified several shortfalls in the pipeline risk assessment’s calculation of threat. First, while the risk assessment assesses consequence and vulnerability by pipeline system through use of multiple variables, it currently ranks threat for pipeline systems equally. Second, the evolving nature of threats to pipelines may not be reflected, since the risk assessment was last updated in 2014. Third, the threat calculation does not take into account natural hazards. Pipeline Security Branch officials said they currently rank threat equally across pipeline systems because they do not have granular enough threat information to distinguish threat by pipeline. However, ranking threat equally effectively has no effect on the risk calculation for pipeline systems. Further, this judgment is not documented in the risk assessment’s methodology. According to the NIPP, a risk assessment’s methodology must clearly document what information is used and how it is synthesized to generate a risk estimate, including any assumptions and judgments. Additionally, our analysis of the pipeline risk assessment found that it includes at least one field that TSA could use to differentiate threat by pipeline. Specifically, the risk assessment includes a field that accounts for whether a pipeline experienced a previous security threat (including failed attacks), and information provided by Pipeline Security Branch suggests some pipeline systems have experienced such threats. However, the Pipeline Security Branch did not capture these events in the risk assessment’s calculation, which Pipeline Security Branch officials said should be part of the threat calculation, but could not account for why they were not calculated for the systems in the risk assessment. These officials also clarified that incidents such as suspicious photography or vandalism do not constitute an attack to be accounted for in the threat calculation. Documenting such assumptions, judgments, or decisions to exclude information could provide increased transparency to those expected to interpret or use the results. Pipeline Security Branch officials also said that they ranked threat equally because TSA Intelligence and Analysis data show that threats to the oil and natural gas sector have been historically low, and Intelligence and Analysis does not conduct specific threat analysis against individual pipeline systems. However, the Pipeline Security Branch has not updated the risk assessment since June 2014; therefore, the threat information it used to determine threat calculations—and decide to rank threat equally—may be outdated and not reflect the threats to the industry that have emerged in recent years. In fact, pipeline operators we interviewed indicated that the types of threats that concern pipeline operators have evolved. For example, 5 of the 10 operators we interviewed indicated that environmental activists were an increased threat to the pipeline industry because they use sabotage techniques, such as valve turning and cutting in service pipelines with blow torches, against pipelines. Additionally, 6 of 10 pipeline operators we interviewed said cyber attacks from nation-state actors were a primary threat to their industry. Further, when TSA issued its revised Pipeline Security Guidelines in March 2018, it stated that its revisions to the guidelines were made to reflect the ever-changing threat environment in both the physical and cybersecurity realms. However, threats to cybersecurity are not specifically accounted for in the description of the risk assessment methodology. Recent Pipeline Modal and Cyber Modal Threat Assessments include cyber threats to the pipeline industry, but the description of the pipeline risk assessment’s methodology does not specify what types of threat assessments (sources) are used to calculate its threat score. To better align with the guidance in the NIPP for documenting sources of information when conducting risk assessments, the Pipeline Security Branch should document the information used. Keeping the risk assessment updated with current information, as well as documenting those data sources, could help the Pipeline Security Branch ensure it is using its limited resources to review the pipeline systems with greater risk. Natural Hazard Threats to Pipelines The Transportation Systems Sector, of which pipelines are a part, is critical to the Pacific Northwest, but also at risk from natural hazards, like earthquakes. For example, according to the Department of Homeland Security, an earthquake in the Puget Sound region—which relies on the transportation of crude oil from Alaska—could cripple the ports of Seattle and Tacoma, as well as the Olympic and Williams Pipelines greatly impacting the Pacific Northwest Economic Region. Hurricanes are the most frequent disruptive natural hazard for the oil and natural gas subsector and can cause the shutdown of facilities in an area, even when the facilities themselves are not directly affected by the storms. For example, according to the U.S. Energy Information Administration, the flow of petroleum into the New York area via pipeline from the Gulf Coast relies on the ability to move it through major terminals. In August 2017, Hurricane Harvey caused major disruptions to crude oil and petroleum product supply chains, including those to New York Harbor from Houston, Texas via the Colonial Pipeline. Due to the hurricane, decreased supplies of petroleum products available for the pipeline in Houston forced Colonial Pipeline to limit operations temporarily. Finally, another shortfall in the current pipeline risk assessment methodology is that it does not account for natural hazards in its threat calculation, even though DHS’s definition of threat includes natural hazards, and security and resilience of critical infrastructure are often presented in the context of natural hazards. According to the NIPP, threat is a natural or manmade occurrence, individual, entity, or action that has or indicates the potential to harm life, information, operations, the environment, and/or property. As such, along with terrorism, criminal activity and cybersecurity, natural disasters are a key element of DHS’s critical infrastructure security and resilience mission. According to Pipeline Security Branch officials, there is not sufficient historical data available that would indicate a significant impact from natural disasters on specific pipeline systems. However, we identified possible sources of data for the Pipeline Security Branch to consider. For example, a 2016 RAND Corporation study examined national infrastructure systems’ exposure to natural hazards, including pipelines. Additionally, the Federal Emergency Management Agency (FEMA) has collaborated with stakeholders to develop the National Risk Index to, among other things, establish a baseline of natural hazards risk for the United States While there may not be historical data of natural hazard impact for every pipeline system, consulting other sources or experts could provide regional data or analysis to build a more comprehensive threat picture to help distinguish threats by pipeline system. According to the NIPP, hazard assessments should rely not only on historical information, but also future predictions about natural hazards to assess the likelihood or frequency of various hazards. We also identified multiple shortfalls in the vulnerability factors used in the risk assessment methodology, such as the potential uncertainty of the number of critical facilities and incorporating a feedback mechanism to calculate overall risk reduction. Other considerations for vulnerability calculations include physical condition of the pipeline system, cybersecurity activities, and interdependencies among sectors. The number of critical facilities a pipeline system has identified is used as an input for its vulnerability calculation in the Pipeline Security Branch’s risk assessment methodology. As discussed earlier, we identified deficiencies in TSA’s criteria for identifying critical facilities, and found that well-defined criteria and consistent application of the criteria for identifying critical facilities could improve the results of the Pipeline Security Branch’s risk assessment. Nevertheless, communicating in the risk assessment the uncertainty that may be inherent in this self-reported information would better align the risk assessment with the NIPP. Measuring Effectiveness in a Voluntary Environment According to the National Infrastructure Protection Plan, the use of performance metrics is an important step in the critical infrastructure risk management process to enable assessment of improvements in critical infrastructure security and resilience. The metrics provide a basis for the critical infrastructure community to establish accountability, document actual performance, promote effective management, and provide a feedback mechanism to inform decision making. By using metrics to evaluate the effectiveness of voluntary partnership efforts to achieve national and sector priorities, critical infrastructure partners can adjust and adapt their security and resilience approaches to account for progress achieved, as well as changes in the threat and other relevant environments. Metrics are used to focus attention on areas of security and resilience that warrant additional resources or other changes through an analysis of challenges and priorities at the national, sector, and owner/operator levels. Metrics also serve as a feedback mechanism for other aspects of the critical infrastructure risk management approach. Another shortfall in the risk assessment is its inability to reliably measure the progress a pipeline system made in addressing vulnerability gaps between security reviews. The current risk assessment includes a CSR score as part of its vulnerability calculation, which was developed in part in response to our 2010 recommendation to use more reliable data to measure a pipeline system’s vulnerability gap. However, during our review, Pipeline Security Branch officials said they plan to remove pipeline companies’ CSR scores from the risk assessment calculations, because they and industry partners do not have confidence that the score appropriately measures a pipeline system’s vulnerability. For example, Pipeline Security Branch officials explained that pipeline companies consider security factors differently, which can lead to variation in implementing risk reduction activities and by extension lead to different CSR scores. However, removing the CSR score eliminates the only feedback mechanism in the risk assessment from a pipeline company’s actual security review conducted by the Pipeline Security Branch. The NIPP and DHS’s Risk Management fundamentals emphasize the important role that such feedback mechanisms play in risk management. Officials from the Pipeline Security Branch agree on the importance of a feedback mechanism tying results of reviews to a revised vulnerability metric, but said they need a better measure than the current CSR score which is unreliable for comparative and analytic purposes. Developing a feedback mechanism based on implementation of TSA’s Pipeline Security Guidelines could be an important input to the risk assessment’s vulnerability calculation. This information would also inform the amount of risk pipeline companies are reducing by implementing the guidelines and could be used to inform overall risk reduction. The physical and cyber environments in which the pipeline sector operates also present vulnerabilities not accounted for in the pipeline risk assessment. In recent years, DHS has listed the potential for catastrophic losses to dramatically increase the overall risk associated with failing infrastructure and highlighted risks due to climate change and natural hazards to pipelines. For example, DHS reported extreme temperatures—such as higher and lower temperatures over prolonged periods of time—increase vulnerability to the critical infrastructure by causing elements to break and cease to function. Pipelines that freeze and then rupture can affect the energy and transportation systems sectors. As noted above, according to the NIPP, a natural or man-made occurrence or action with the potential to harm life is considered a threat, whereas vulnerability is defined as a physical feature or operational attribute that renders an entity open to exploitation or susceptible to a given threat or hazard. While pipeline physical condition is typically thought of in context of safety, pipeline condition or location (such as above or below ground) could touch upon pipeline security as it relates to system vulnerability. For example, a pipeline system or segment of a system with a compromised physical condition due to corrosion or age could affect the system’s vulnerability to threats and affect its ability to recover from such threats by potentially increasing the time a system is offline. According to the Transportation Systems Sector-Specific Plan, vulnerabilities to damage in aging transportation infrastructure—of which pipelines are a part—are projected to increase with the continued effects of climate change. Further, according to TSA’s Pipeline Security and Incident Recovery Protocol Plan, pipeline integrity efforts—including the design, construction, operation, and maintenance of pipelines—are important to pipeline security because well-maintained, safe pipelines are more likely to tolerate a physical attack. The Pipeline Security Branch already collects information from the Pipeline and Hazardous Materials Safety Administration (PHMSA) for its risk assessment, specifically information on High Consequence Area and High Threat Urban Area mileage. By considering additional information PHMSA collects on pipeline integrity, the Pipeline Security Branch could also use the information to help pipeline operators identify security measures to help reduce the consequences related to the comparatively higher vulnerability of an aging or compromised system. This would align with the Pipeline Security Branch’s efforts to improve security preparedness of pipeline systems and could better inform its vulnerability calculations for relative risk ranking of pipeline systems. Capturing cybersecurity in the risk assessment is also an area for improvement. Pipeline Security Branch officials told us they consulted with the National Cybersecurity and Communications Integration Center to revise TSA’s Pipeline Security Guidelines to align with the National Institute of Standards and Technology (NIST) Cybersecurity Framework and that absent data specific to pipelines on their cybersecurity vulnerabilities, they are unable to include a pipelines’ vulnerability to cyber attack in the risk assessment. However, the Pipeline Security Branch recently updated the security review questions asked of pipeline operators during corporate and critical facility reviews based on the recently updated Pipeline Security Guidelines. Using these updated questions related to companies’ cybersecurity posture, the Pipeline Security Branch could collect additional information on cybersecurity vulnerabilities which could inform the risk assessment. This could be an element of the feedback mechanism described above and emphasized in the NIPP. Additionally, NIST identified several supply chain vulnerabilities associated with cybersecurity, which are not currently accounted for in TSA’s Pipeline Security Guidelines. As pipeline operators implement increasing levels of network technologies to control their systems, the Pipeline Security Branch may not be fully accounting for pipeline systems’ cybersecurity posture by not including the cybersecurity-related vulnerabilities in its risk assessment inputs. Finally, we identified shortfalls in cross-sector interdependencies, which could affect vulnerability calculations. According to the NIPP, understanding and addressing risks from cross-sector dependencies and interdependencies is essential to enhancing critical infrastructure security and resilience. The Pipeline Security Branch’s pipeline risk assessment currently considers the effects of a pipeline system’s ability to service assets such as major airports, the electric grid, and military bases. However, consequence is calculated on the loss or disruption of the pipeline system to these other assets and does not capture the dependency of the pipeline system on other energy sources, such as electricity. Weather events such as Gulf of Mexico hurricanes and Superstorm Sandy highlighted the interdependencies between the pipeline and electrical sectors. Specifically, according to a 2015 DHS annual report on critical infrastructure, power failures during Superstorm Sandy in 2012 closed major pipelines for 4 days, reducing regional oil supplies by 35 to 40 percent. The report goes on to say that the interconnected nature of infrastructure systems can lead to cascading impacts and are increasing in frequency. Pipeline Security Branch officials are considering cross-sector interdependencies and said they discuss these factors with operators as they relate to system resiliency. Considering interdependencies of sectors in both directions—such as calculating the likelihood that an input like electricity could fail and cause disruptions to critical pipelines—could improve the calculations in the pipeline risk assessment. As previously discussed, the Pipeline Security Branch last calculated relative risk among the top 100 pipeline systems in 2014. When doing so, it used pipeline systems’ throughput data from 2010 to assess relative risk. According to Pipeline Security Branch officials, the amount of throughput in pipeline systems does not change substantially year to year. However, Standards for Internal Control in the Federal Government calls for management to use quality information to achieve the entity’s objectives, including using relevant data from reliable sources obtained in a timely manner. The Pipeline Security Branch uses throughput data as a consequence factor in the risk assessment to determine a pipeline system’s relative risk score. Throughput changes could affect relative risk ranking and the Pipeline Security Branch’s ability to accurately prioritize reviews based on relative risk. Chris P. Currie at (404) 679-1875 or curriec@gao.gov Nick Marinos at (202) 512-9342 or marinosn@gao.gov. In addition to the contacts named above, Ben Atwater, Assistant Director; Michael W. Gilmore, Assistant Director; and Michael C. Lenington, Analyst-in-Charge, managed this assignment. Chuck Bausell, David Blanding, Dominick Dale, Eric Hauswirth, Kenneth A. Johnson, Steve Komadina, Susanna Kuebler, Thomas Lombardi, David Plocher, and Janay Sam made significant contributions to this report.

Question: Write a one-page summary of the report 1.

Answer: The International Emergency Economic Powers Act (IEEPA) provides the President broad authority to regulate a variety of economic transactions following a declaration of national emergency. IEEPA, like the Trading with the Enemy Act (TWEA) from which it branched, sits at the center of the modern U.S. sanctions regime. Changes in the use of IEEPA powers since the act's enactment in 1977 have caused some to question whether the statute's oversight provisions are robust enough given the sweeping economic powers it confers upon the President upon declaration of a state of emergency. Over the course of the twentieth century, Congress delegated increasing amounts of emergency power to the President by statute. The Trading with the Enemy Act was one such statute. Congress passed TWEA in 1917 to regulate international transactions with enemy powers following the U.S. entry into the First World War. Congress expanded the act during the 1930s to allow the President to declare a national emergency in times of peace and assume sweeping powers over both domestic and international transactions. Between 1945 and the early 1970s, TWEA became a critically important means to impose sanctions as part of U.S. Cold War strategy. Presidents used TWEA to block international financial transactions, seize U.S.-based assets held by foreign nationals, restrict exports, modify regulations to deter the hoarding of gold, limit foreign direct investment in U.S. companies, and impose tariffs on all imports into the United States. Following committee investigations that discovered that the United States had been in a state of emergency for more than 40 years, Congress passed the National Emergencies Act (NEA) in 1976 and IEEPA in 1977. The pair of statutes placed new limits on presidential emergency powers. Both included reporting requirements to increase transparency and track costs, and the NEA required the President to annually assess and extend, if appropriate, the emergency. However, some experts argue that the renewal process has become pro forma. The NEA also afforded Congress the means to terminate a national emergency by adopting a concurrent resolution in each chamber. A decision by the Supreme Court, in a landmark immigration case, however, found the use of concurrent resolutions to terminate an executive action unconstitutional. Congress amended the statute to require a joint resolution, significantly increasing the difficulty of terminating an emergency. Like TWEA, IEEPA has become an important means to impose economic-based sanctions since its enactment; like TWEA, Presidents have frequently used IEEPA to restrict a variety of international transactions; and like TWEA, the subjects of the restrictions, the frequency of use, and the duration of emergencies have expanded over time. Initially, Presidents targeted foreign states or their governments. Over the years, however, presidential administrations have increasingly used IEEPA to target individuals, groups, and non-state actors such as terrorists and persons who engage in malicious cyber-enabled activities. As of March 1, 2019, Presidents had declared 54 national emergencies invoking IEEPA, 29 of which are still ongoing. Typically, national emergencies invoking IEEPA last nearly a decade, although some have lasted significantly longer--the first state of emergency declared under the NEA and IEEPA, which was declared in response to the taking of U.S. embassy staff as hostages by Iran in 1979, may soon enter its fifth decade. IEEPA grants sweeping powers to the President to control economic transactions. Despite these broad powers, Congress has never attempted to terminate a national emergency invoking IEEPA. Instead, Congress has directed the President on numerous occasions to use IEEPA authorities to impose sanctions. Congress may want to consider whether IEEPA appropriately balances the need for swift action in a time of crisis with Congress' duty to oversee executive action. Congress may also want to consider IEEPA's role in implementing its influence in U.S. foreign policy and national security decision-making.