Security Assessment from September 2008 Report

Select agent regulations do not mandate that specific perimeter security  controls be present at BSL-4 labs, resulting in a significant difference in  perimeter security between the nation’s five labs. According to the  regulations, each lab must implement a security plan that is sufficient to  safeguard select agents against unauthorized access, theft, loss, or release.  However, there are no specific perimeter security controls that must be in  place at every BSL-4 lab. Although BSL-4 labs may have different levels of  inherent risk, we determined that these 15 controls (discussed in more  detail in app. I) represent a baseline for strong perimeter security. While  three labs had all or nearly all of the key security controls we assessed,  our September 2008 report demonstrated that two labs (Labs C and E) had  a significant lack of these controls. See table 1 below.
Lab C: Lab C had in place only 3 of the 15 key security controls we  assessed. The lab was in an urban environment and publicly accessible,  with only limited perimeter barriers. During our assessment, we saw a  pedestrian access the building housing the lab through the unguarded  loading dock entrance. In addition to lacking any perimeter barriers to  prevent unauthorized individuals from approaching the lab, Lab C also  lacked an active integrated security system. By not having a command and  control center or an integrated security system with real-time camera  monitoring, the possibility that security officers could detect an intruder  entering the perimeter and respond to such an intrusion is greatly reduced.
Lab E: Lab E was one of the weakest labs we assessed, with 4 out of the  15 key controls in place. It had only limited camera coverage of the outer  perimeter of the facility and the only vehicular barrier consisted of an arm  gate that swung across the road. Although the guard houses controlling  access to the facility were manned, they appeared antiquated and thus did  not portray a strong, professional security infrastructure. The security  force charged with protecting the lab was unarmed. Of all the BSL-4 labs  we assessed, this was the only lab with an exterior window that could  provide direct access to the lab. In lieu of a command and control center,  Lab E contracts with an outside company to monitor its alarm in an off- site facility. This potentially impedes response time by emergency  responders with an unnecessary layer that would not exist with a  command and control center. Since the contracted company is not  physically present at the facility, it is not able to ascertain the nature of  alarm activation. Furthermore, there is no interfaced security system  between alarms and cameras and a lack of real-time monitoring of  cameras.
Although the presence of the controls we assessed does not automatically  ensure a secure perimeter, having most of these controls in place and  operating effectively reduces the likelihood of intrusion. As such, we  recommended in the September 2008 report that the Director of CDC take  action to implement specific perimeter controls for all BSL-4 labs to  provide assurance that each lab has a strong perimeter security system in  place. As part of this recommendation, we stated that CDC should work  with USDA to coordinate its efforts, given that both agencies have the  authority to regulate select agents. In its response to the September 2008  report, HHS agreed that perimeter security is an important deterrent  against theft of select agents. HHS indicated that the difference in  perimeter security at the five labs was the result of risk-based planning;  however, they did not comment on the specific vulnerabilities we  identified and whether these should be addressed. In regard to requiring  specific perimeter controls for all BSL-4 labs, HHS stated that it would  perform further study and outreach to determine whether additional  federal regulations are needed.

	CDC Has Taken Limited Action to Require Specific Perimeter Security Controls

Significant perimeter security differences continue to exist among the  nation’s five BSL-4 labs operational at the time of our most recent  assessment. In our July 2009 report, we stated that CDC has taken limited  steps to address our recommendation that it should take action to  implement specific perimeter security controls for all BSL-4 labs. CDC  stated that the following actions have been taken as of May 2009:  In late 2007, CDC, along with other federal agencies, established a U.S.  Government Trans-Federal Task Force on Optimizing Biosafety and  Biocontainment Oversight. The task force was formed to assess the  current framework for local and federal oversight of high-containment  laboratory research activities and facilities, including the identification  and assessment of pertinent laws, regulations, policies, guidelines, and  examination of the current state of biosafety oversight systems. The  task force held a public consultation meeting in December 2008.  According to CDC, the task force will communicate specific  recommendations about the nation’s lab safety and security issues to  the Secretaries of both HHS and USDA.
CDC and USDA hosted a workshop series in Greenbelt, Maryland, in  December 2008 for all of their registered entities and partners. CDC  stated that it included several safety and security topics, including  discussion of physical security and operational security.
In January 2009, in response to Executive Order 13486, a federal  working group (WG) was convened to review current laws, regulations,  and guidelines in place to prevent theft, misuse, or diversion to  unlawful activity of select agents and toxins. The WG is chaired by HHS  and the Department of Defense (DOD) and includes representatives  from several federal agencies and includes a subgroup that is focused  on physical and facility security of biolabs. The WG is expected to issue  its final report to the President.
Although CDC has taken some modest steps for studying how to improve  perimeter security controls for all BSL-4 labs, CDC has not established a  detailed plan to implement our recommendation. Without a detailed plan  from CDC on what corrective actions are planned, it is impossible to  monitor CDC’s progress in implementing our recommendation to improve  perimeter security controls for all BSL-4 labs. The ability to monitor  progress openly and transparently is especially important because a sixth  BSL-4 lab recently became operational, as mentioned above, and CDC  expects more BSL-4 labs to be operational in the future.

	Two Labs Take Action to Improve Perimeter Security Controls

Although CDC has taken limited action to address our findings from our  September 2008 report, the two deficient BSL-4 labs have made progress  on their own. In our July 2009 report, we stated that one BSL-4 lab made a  significant number of improvements to increase perimeter security, thus  reducing the likelihood of intrusion. The second one made three changes  and formed a committee to consider and prioritize other changes.

		Lab C

We confirmed the following improvements at Lab C:    Visitors are screened by security guards and issued visitor badges.
A command and control center was established.
Camera coverage includes all exterior lab entrances.
Closed-circuit television (CCTV) is monitored by the command and  control center. The cameras currently cover the exterior of the  building. Guards can control the cameras by panning, zooming, or  tilting.
One visible guard is present at the main entrance to the lab, but the  guard is not armed. A guard mans the entrance 24-hours a day, 7 days a  week. Although the guard is unarmed, this improvement does partially  address the requirement for guard presence at lab public entrances.  Lab officials described installing armed guards as cost prohibitive.
While the loading dock is still located inside the footprint of the main  building, Lab C improved its loading dock security by building a  loading dock vehicle gate. Moreover, a pedestrian gate with a sign  forbidding entry was built to prevent pedestrians from entering the  building through the loading dock; pedestrians were previously allowed  to enter the building through the loading dock as a way of taking a  short-cut into the building. These new gates prevent individuals from  walking into the building, or vehicles driving up to the building,  unchallenged.
Lab officials said additional enhancements would be completed by fall  2009. These include an active intrusion detection system that is integrated  with CCTV and the addition of 14 new interior cameras with pan, tilt, and  zoom capabilities. The new cameras will enhance the interior perimeter  security of the lab. The command and control center also will have access  to and control of these new cameras. After these improvements are  finished, the lab will have 8 of the 15 controls we tested in place plus 2  others that were partially addressed.

		Lab E

We verified three improvements were made at Lab E—heavy concrete  planters were added as a vehicle barricade along the roadside adjacent to  the building; the window was frosted to block sight lines into the lab from  nearby rooftops; and a vehicle barricade is being constructed to block  unauthorized access to the parking lot adjacent to the lab, thereby  increasing the blast stand-off area. The lab also formed a committee to  consider additional perimeter security measures such as widening buffer  zones and increasing lighting at the perimeter fence. In all, the lab now has  6 of the 15 controls we assessed in place.
Although lab officials made three improvements and are considering  others, the lab’s head of research operations at the facility objected to the  findings of our September 2008 report and has challenged the 15 controls  we deemed critical to strong perimeter security. He said that the officials  from the lab were not afforded an opportunity to respond to the report and  correct “inaccuracies.” Specifically, he made the following comments on  our previous findings:    He questioned the basis for our selection of the specific 15 controls we  identified as critical to perimeter security, and noted that CDC also  expressed similar concerns in its comments on our September 2008  report.
The lab windows do not provide direct access to the lab. He maintained  that a number of features prohibited entry by these windows: the  lowermost edge of the windows is more than 7 feet 8 inches above  ground level, the windows are certified bulletproof glass and are  equipped with inside bars, and breaching the integrity of the outer  bulletproof glass triggers alarms for the local guard force. Furthermore,  he said that having such a window was deemed programmatically  important when the laboratory was designed in order to provide light- dark orientation for laboratory workers. Finally, he represented that a  group of nationally recognized security experts has opined that the  windows are not a security threat, but did not provide evidence of  these experts’ assessment.
Armed guards are present on the campus. He stated that a table in our  September 2008 report indicates that armed guards are not present on  the campus, although a footnote on a subsequent page acknowledges  that an armed security supervisor patrols the facility.
A vehicle barrier does surround the perimeter of that portion of the  laboratory building housing select agents, including the BSL-4  laboratory. He said it was recommended and approved by the Federal  Bureau of Investigation during consultations on the safety of the  building and installed in 1999 prior to initiation of research in this  facility.
We continue to believe that our assessment of perimeter controls at Lab E is  accurate. Specifically, we disagree with Lab E’s position as follows:   As stated in the September 2008 report, we developed the 15 security  controls based on our expertise in performing security assessments  and our research of commonly accepted physical security principles.  Although we acknowledge that the 15 security controls we selected are  not the only measures that can be in place to provide effective  perimeter security, we determined that these controls (discussed in  more detail in app. I) represent a baseline for BSL-4 lab perimeter  physical security and contribute to a strong perimeter security system.  Having a baseline provides fair representation as to what key perimeter  security controls do or do not exist at these facilities. The controls  represent commonly accepted physical security principles. A lack of  such controls represents a potential security vulnerability. For  example, as mentioned above, at the time of our original assessment  Lab E had only limited camera coverage of the outer perimeter of the  facility. Camera coverage of a building’s exterior provides a means to  detect and quickly identify potential intruders.
As mentioned above, Lab E was the only lab with an exterior window  that could provide direct access to the lab. This window allowed for  direct “visual” access into the lab area from an adjacent rooftop. Lab E  in essence acknowledged this when it informed us in a letter that it  “Frosted the BSL-4 laboratory windows to block sight lines from  adjacent rooftops.” While we credited Lab E for obscuring visual  access to the lab by frosting this window, the window continues to  pose a security vulnerability because it is not blast proof.
Armed guards are not present on the campus. As mentioned above, Lab  E’s head of research operations pointed out that our September 2008  report acknowledged that an armed security supervisor patrols the  facility. However, employing one armed security supervisor does not  support the plural definition of “guards.” The supervisor also is not  generally at the entrances to the facility. He normally responds to  incidents and would not generally be in a position to confront an  intruder at the point of attack. Furthermore, placing armed guards at  entrances also functions as a deterrent.
The vehicle barrier did not surround the full perimeter of the BSL-4 lab  building as it adjoined another lab building at the time of our original  assessment. The facility has since placed additional barriers as noted in  this testimony to give full coverage, thus validating our original  assessment. Furthermore, part of the barrier in the area between a  small parking lot and the BSL-4 lab building did not provide an  adequate blast stand-off area. The lab, as noted in the July 2009 report,  has since erected barriers to this parking lot to allow only deliveries  into the area.
The following table summarizes the progress the two labs have made on 9  of the 15 controls we initially assessed.

	Additional Observations on Federal Oversight of BSL-4 Labs

In our July 2009 report, we made two additional observations that concern  perimeter security differences among the nation’s five BSL-4 labs that  were operational at the time of our assessment:    All five BSL-4 labs operating in 2008 had a security plan in place when  we assessed them. Yet significant perimeter security differences exist  among these high-containment labs. A reason for the discrepancies can  be found in the additional federal security requirements the three labs  with strong perimeter security controls in place had to follow beyond  the select agent regulations. For example, Lab B is a military facility  subject to far stricter DOD physical security requirements. It had a  perimeter security fence and roving patrol guards visible inside and  outside this fence. Labs A and D also must meet additional mandates  from the federal agencies that oversee them. A lack of minimum  perimeter security requirements contributes to sharp differences  among BSL-4 labs as well.]    CDC inspection officials stated their training and experience had been  mainly in the area of safety. They also noted that their philosophy is a  layered approach to security and safety. According to CDC officials,  they are developing a comprehensive strategy for safety and security of  biosafety labs and will adjust the training and inspection process  accordingly to match this comprehensive strategy.

	Agency and Third- Party Comments

We made no new recommendations in our July 2009 report. In responding  to our report, CDC stated that multiple groups are assessing the issue of  laboratory security and developing related recommendations. CDC stated  that it will consider our prior recommendation and the reports from the  multiple groups together before developing a detailed plan to address  security at select agent laboratories. CDC also stated that it is in the  process of hiring a Security Officer to provide continued focus on  laboratory security. Labs C and E commented on relevant sections of our  report, indicating that they have taken or plan to take various actions to  improve perimeter security.
Mr. Chairman and Members of the Committee, this completes my prepared  statement. I would be happy to respond to any questions you or other  Members of the Committee may have at this time.

Appendix I: Perimeter Security Controls

To perform our perimeter security assessment of biosafety level 4 (BSL-4)  labs, we identified 15 key perimeter security controls. We based their  selection on our expertise and research of commonly accepted physical  security principles that contribute to a strong perimeter security system. A  strong perimeter security system uses layers of security to deter, detect,  delay, and deny intruders:    Deter. Physical security controls that deter an intruder are intended to  reduce the intruder’s perception that an attack will be successful—an  armed guard posted in front of a lab, for example.
Detect. Controls that detect an intruder could include video cameras  and alarm systems. They could also include roving guard patrols.
Delay. Controls that delay an intruder increase the opportunity for a  successful security response. These controls include barriers such as  perimeter fences.
Deny. Controls that can deny an intruder include visitor screening that  only permits authorized individuals to access the building housing the  lab. Furthermore, a lack of windows or other obvious means of  accessing a lab is an effective denial mechanism.
Some security controls serve multiple purposes. For example, a perimeter  fence is a basic security feature that can deter, delay, and deny intruders.  However, a perimeter fence on its own will not stop a determined intruder.  This is why, in practice, layers of security must be integrated in order to  provide the strongest protection. Thus, a perimeter fence should be  combined with an intrusion detection system that would alert security  officials if the perimeter has been breached. A strong system would then  tie the intrusion detection alarm to the closed-circuit television (CCTV)  network, allowing security officers to immediately identify intruders. A  central command center is a key element for an integrated, active system.  It allows security officers to monitor alarm and camera activity—and plan  the security response—from a single location. Table 3 shows 15 physical  security controls we focused on during our assessment work.

Appendix II: GAO Contact and Staff Acknowledgments

	GAO Contact

	Acknowledgments

In addition to the contact named above, the following individuals made  contributions to this testimony: Andy O’Connell, Assistant Director; Matt  Valenta, Assistant Director; Christopher W. Backley; Randall Cole; John  Cooney; Craig Fischer; Vicki McClure; Anthony Paras; and Verginie  Tarpinian.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.

Summary:
Why GAO Did This Study

Biosafety laboratories are primarily regulated by either the Department of Health and Human Services (HHS) or the U.S. Department of Agriculture (USDA), depending on whether the substances they handle pose a threat to the health of humans or plants, animals, and related products, respectively. Currently, all operational biosafety level 4 (BSL-4) labs are overseen by HHS's Centers for Disease Control and Prevention (CDC). BSL-4 labs handle the world's most dangerous agents and toxins that cause incurable and deadly diseases. This testimony summarizes GAO's previously issued reports on perimeter security at the nation's BSL-4 laboratories that were issued in September 2008 (GAO-08-1092) and July 2009 (GAO-09-851). Specifically, this testimony describes (1) the findings and recommendation on key perimeter security controls at five of the nation's operational BSL-4 labs, (2) CDC efforts to address our recommendation, (3) improvements that have been made to the perimeter security controls at the two labs found to be deficient, and (4) other observations about the BSL-4 labs GAO assessed.

What GAO Found

Significant perimeter security differences continue to exist among the nation's five BSL-4 laboratories operational at the time of GAO's assessment. In September 2008, GAO reported that three of the five labs had all or nearly all of the 15 key controls GAO evaluated. Two labs, however, demonstrated a significant lack of these controls, such as camera coverage for all exterior lab entrances and vehicle screening. As a result, GAO recommended that CDC work with USDA to require specific perimeter security controls at high-containment facilities. However, as we reported in July 2009, CDC has taken limited action on the GAO recommendation. In July 2009, GAO reported that the two deficient labs made progress on their own despite CDC's limited action. One made a significant number of improvements, thus reducing the likelihood of intrusion. The second made a few changes and formed a committee to consider and prioritize other improvements. Two additional observations about BSL-4 labs concern the significant perimeter security differences among the five labs GAO originally assessed for our September 2008 report. First, labs with stronger perimeter controls had additional security requirements mandated by other federal agencies. For example, one lab is a military facility subject to far stricter Department of Defense physical security requirements. Second, CDC inspection officials stated their training and experience has been focused on safety. CDC officials said they are developing a comprehensive strategy for safety and security of labs and will adjust the training and inspection process to match this strategy.