Testimony 

Before the Committee on Homeland 

Security and Governmental Affairs, U.S. 

Senate

United States Government Accountability Office

GAO

For Release on Delivery 

Expected at 10:00 a.m. EDT 

Wednesday, April 27, 2005 HOMELAND SECURITY

Federal and Industry Efforts 

Are Addressing Security 

Issues at Chemical 

Facilities, but Additional 

Action Is Needed 

Statement of John B. Stephenson, Director 

Natural Resources and Environment 

GAO-05-631T 
What GAO Found

United States Government Accountability Office

Why GAO Did This Study

Highlights

Accountability Integrity Reliability

www.gao.gov/cgi-bin/getrpt?GAO-05-631T.

To view the full product, including the scope 

and methodology, click on the link above. 

For more information, contact John 

Stephenson at (202) 512-3841 or 

stephensonj@gao.gov. 

Highlights of GAO-05-631T, testimony

before the Committee on Homeland 

Security and Governmental Affairs, U. S. 

Senate 

April 27, 2005

HOMELAND SECURITY

Federal and Industry Efforts Are 

Addressing Security Issues at Chemical 

Facilities, but Additional Action Is Needed 

Experts agree that the nation’s chemical facilities are attractive targets for 

terrorists. The theft or release of certain chemicals could disrupt the local 

economy, impact other critical infrastructures that rely on chemicals, or 

impact the health and safety of millions of Americans. For example, a 2002 

Brookings Institution report ranks an attack on toxic chemical plants behind 

only biological and atomic attacks in terms of possible fatalities. While 

several efforts are underway, no one has yet comprehensively assessed 

security at the nation’s chemical facilities. 

The chemical sector includes a variety of facilities and risks. The 15,000 

facilities with large amounts of the most dangerous chemicals include 

chemical manufacturers, water supply facilities, and fertilizer facilities, 

among others. Some facilities may be at higher risk of a terrorist attack than 

others because of the specific chemicals on site and their proximity to 

population centers. According to 2003 EPA data, 123 U.S. chemical facilities 

had “worst-case” scenarios where more than one million people could be at 

risk of exposure to a cloud of toxic gas. While EPA and DHS believe that 

these scenarios overstate the potential consequences of a chemical release, 

there are situations where an attack could have potentially more severe 

consequences. 

Only about one-sixth of the 15,000 facilities with large amounts of dangerous 

chemicals are covered by federal security requirements. About 2,000 

community water systems and 238 facilities that are located on waterways 

and handle “bulk liquid chemicals” must conduct vulnerability assessments, 

among other things, under the Public Health Security and Bioterrorism 

Response Act of 2002 and the Maritime Transportation Security Act of 2002, 

respectively. However, the federal government places requirements on 

chemical facilities to address accidental releases, which may also reduce the 

likelihood and mitigate the consequences of terrorist attacks. 

A number of federal and industry efforts are underway to enhance chemical 

facility security. DHS is developing a strategy to protect the chemical sector, 

identify high-risk facilities, and integrate chemical sector protection efforts 

into a national program. With no authority to require facilities to improve 

security, DHS has provided the industry with financial assistance, 

information, and training, assessed facility vulnerability, and recommended 

security improvements. About 1,100 facilities participate in a voluntary 

industry effort in which they assess vulnerabilities, develop security plans, 

and undergo a third party verification that the facilities implemented the 

identified physical security enhancements. The extent to which the 

remaining facilities are addressing security is unclear and the extent of 

chemical facilities’ security preparedness is unknown. In this context, a 

comprehensive national strategy to identify high-risk facilities and require 

facilities to assess their vulnerabilities, among other actions, would help to 

ensure that security vulnerabilities at chemical facilities are addressed. 

Terrorist attacks on chemical 

facilities could severely damage the 

U.S. economy and public health. 

About 15,000 facilities produce, 

use, or store large amounts of 

chemicals that pose the greatest 

risk to human health and the 

environment. While the 

Environmental Protection Agency 

(EPA) formerly had the lead role in 

federal efforts to ensure chemical 

facility security, the Department of 

Homeland Security (DHS) is now 

the lead federal agency responsible 

for coordinating government and 

private efforts to protect these 

facilities from terrorist attacks. 

This testimony is based on GAO’s 

past work on chemical facility 

security and focuses on (1) the 

attractiveness of chemical facilities 

as terrorist targets, (2) their 

diversity and risks, (3) federal 

security requirements for these 

facilities, and (4) federal and 

industry efforts to improve facility 

security. 

What GAO Recommends

In March 2003, GAO recommended 

that DHS and EPA develop (1) a 

comprehensive chemical security 

strategy and (2) a legislative 

proposal to require facilities to 

assess their vulnerability to attacks 

and require corrective action. At 

that time, DHS and EPA generally 

agreed with these 

recommendations and, while EPA 

no longer has a key role in ensuring 

chemical facility security, DHS is 

taking steps to implement them. 
Page 1 GAO-05-631T 

Madame Chairman and Members of the Committee: 

Thank you for this opportunity to discuss our work on chemical facility 

security.1

 As the events of September 11, 2001, showed, a terrorist attack 

on infrastructure that is critical to our nation’s economy can cause 

enormous damage to our country and jeopardize public health and safety. 

The USA PATRIOT Act defined critical infrastructure as those “systems 

and assets...so vital to the United States that the incapacity or destruction 

of such systems and assets would have a debilitating impact on security, 

national economic security, national public health or safety, or any 

combination of those matters.”2

 We often take these systems for granted 

because they are so basic in our daily lives that we generally only notice 

them when their service is interrupted. The President’s February 2003 

National Strategy for the Physical Protection of Critical Infrastructures 

and Key Assets sets forth the federal government’s goals, objectives, and 

responsibilities in protecting the nation’s critical infrastructure. The 

strategy, as well as a presidential directive issued in December 2003, 

identified the chemical industry among the sectors that are critical to the 

nation’s infrastructure.3

 The chemical sector produces, uses, stores, and 

distributes the chemicals needed to manufacture thousands of products, 

such as those used in agriculture, pharmaceuticals, and automobiles. 

The national strategy states that the private sector bears primary 

responsibility for protecting their facilities from deliberate acts of 

terrorism. While federal, state, and local governments work in partnership 

with the private sector to protect chemical facilities, before September 11, 

2001, attention was largely focused on the risks of accidental, rather than 

intentional, chemical releases. In this regard, the Environmental 

Protection Agency (EPA) regulates about 15,000 facilities under the Clean 

Air Act because they produce, use, or store more than certain threshold 

amounts of specific chemicals that would pose the greatest risk to human 

health and the environment if accidentally released into the air. These 

 1

GAO, Homeland Security: Voluntary Initiatives Are Under Way at Chemical Facilities, 

but the Extent of Security Preparedness is Unknown, GAO-03-439 (Washington, D.C.: 

March 2003) and Protection of Chemical and Water Infrastructure: Federal 

Requirements, Actions of Selected Facilities, and Remaining Challenges, GAO-05-327

(Washington, D.C.: March 2005). 

2

Pub. L. No. 107-56, § 1016(e) (2001) (codified at 42 U.S.C. § 5195c(e)). 

3

Homeland Security Presidential Directive Number 7 (Washington, D.C.: December 17, 

2003). 
Page 2 GAO-05-631T 

facilities must take a number of steps, including preparing a risk 

management plan (RMP), to prevent and prepare for an accidental release 

and, therefore, are referred to as “RMP” facilities. While EPA initially had 

the lead responsibility for protecting the chemical infrastructure sector, 

the Department of Homeland Security (DHS) is now the lead federal 

agency. DHS is responsible for coordinating the efforts of government and 

private institutions to protect critical infrastructure, including the 

chemical sector, from terrorist attacks. 

My remarks today are based on our March 2003 and March 2005 reports, 

and will focus on (1) experts’ views on the attractiveness of chemical 

facilities as terrorist targets, (2) the diversity of these facilities and their 

risks, (3) federal requirements that address security at these facilities, and 

(4) an overview of steps the federal government and industry have taken 

to improve facility security. For this work, we interviewed officials from 

EPA, DHS, and the Department of Justice; reviewed pertinent federal 

legislation, EPA data, and available reports; and interviewed industry 

representatives from the American Chemistry Council, other industry 

associations, and a number of chemical companies. We conducted our 

work according to generally accepted government auditing standards. We 

are currently reviewing ongoing federal and industry efforts to improve 

chemical facility security, including the need for further regulation. We 

plan to issue a report on our findings later this year. 

In summary, we found the following: 

• Experts agree that the nation’s chemical facilities present an attractive 

target for terrorists intent on causing massive damage. For example, the 

Department of Justice has concluded that the risk of an attempt in the 

foreseeable future to cause an industrial chemical release is both real and 

credible. Terrorist attacks involving the theft or release of certain 

chemicals could significantly impact the health and safety of millions of 

Americans, disrupt the local or regional economy, or impact other critical 

infrastructures that rely on chemicals, such as drinking water and 

wastewater treatment systems. Despite efforts by DHS to assess facility 

vulnerabilities and suggest security improvements, no one has 

comprehensively assessed security at facilities that house chemicals 

nationwide. 

• DHS has not yet determined the number and type of facilities that should 

be considered as part of the chemical infrastructure sector. The universe 

of facilities with chemicals is diverse, and they present a variety of risks. 

Summary 
Page 3 GAO-05-631T 

About 15,000 RMP facilities produce, use, or store more than threshold 

amounts of chemicals that EPA has estimated pose the greatest risk to 

human health and the environment if they were accidentally released into 

the air. RMP facilities include chemical manufacturers, water supply and 

wastewater treatment facilities, agricultural suppliers such as fertilizer 

facilities, food storage facilities, pulp and paper manufacturers, and iron 

and steel mills, among others. Some facilities may be at higher risk of a 

terrorist attack than others because of the chemicals they house and their 

proximity to population centers. According to 2003 EPA data, the toxic 

“worst-case” scenarios for 123 chemical facilities stated that more than 

one million people could be at risk of exposure to a cloud of toxic gas. 

About 600 facilities could each potentially threaten between 100,000 and a 

million people and about 2,300 facilities could each potentially threaten 

anywhere from 10,000 to 100,000 people. According to EPA and DHS, the 

method for calculating these scenarios overstates the potential 

consequences of a chemical release. However, because the scenarios 

estimate the effects of an accidental toxic chemical release involving the 

greatest amount of the toxic chemical held in a single vessel or pipe, not 

the entire quantity on site, an attack that breached multiple chemical 

vessels simultaneously could result in a larger release with potentially 

more severe consequences than those outlined in “worst-case” scenarios. 

• Currently, no federal requirements comprehensively address security at all 

U.S. chemical facilities. Only about one-sixth of the 15,000 RMP facilities 

must comply with federal security requirements related to terrorism. 

Approximately 2,000 RMP facilities are community water systems subject 

to the Public Health Security and Bioterrorism Response Act of 2002 and 

therefore must conduct vulnerability analyses of their facilities, among 

other things. According to the Coast Guard, 238 chemical facilities that are 

located on waterways and handle “bulk liquid chemicals” must assess the 

vulnerabilities of certain facilities and develop and implement security 

plans under the Maritime Transportation Security Act of 2002 and its 

implementing regulations. The remaining chemical facilities are not 

subject to such security requirements. Although the federal government 

does not require all chemical facilities to adopt security measures against 

acts of terrorism, it does impose safety and emergency response 

requirements on chemical facilities to address accidental releases. These 

requirements may incidentally reduce the likelihood and mitigate the 

consequences of terrorist attacks. 

• The federal government and the chemical industry have taken a number of 

steps to enhance security at chemical facilities but further action is 

needed. DHS’ Information Analysis and Infrastructure Protection 

Directorate is developing a strategy for protecting the chemical sector, 
Page 4 GAO-05-631T 

identifying high-risk facilities, and integrating chemical sector protection 

efforts into a national program. Without specific authority to require 

chemical facilities to improve security, DHS has worked with the chemical 

industry by providing financial assistance, sharing information about 

critical infrastructure protection, assessing facility vulnerabilities, 

recommending security improvements, and providing training. In addition, 

the chemical industry, led by its industry associations, is conducting 

voluntary initiatives at member facilities. The primary industry security 

initiative, the American Chemistry Council’s Responsible Care 

Management System®, directs participating facilities to assess 

vulnerabilities, develop security plans, and undergo a third party 

verification that the facilities implemented the identified physical security 

enhancements. These third parties are not required, however, to verify that 

the vulnerability assessment is appropriately conducted and that the 

actions taken by the facility adequately address security risks. 

Nevertheless, ACC’s self-initiated requirements incorporate elements of a 

risk management framework and were designed to strengthen security at 

its members’ facilities. Approximately 1,100 (or 7 percent) of the 15,000 

RMP facilities are members of ACC and the Synthetic Organic Chemical 

Manufacturers Association—which represents manufacturers who 

produce specialty-chemicals at small- to medium-sized facilities—and, 

thus, are to comply with the Responsible Care® security requirements. 

However, the extent to which the remaining 14,000 RMP facilities, or other 

chemical facilities that are not RMP facilities, may be voluntarily 

addressing their security is unclear. Consequently, despite government 

and industry efforts, the extent of security preparedness at chemical 

facilities is unknown. 

To ensure that chemical facilities take action to review and address 

security vulnerabilities, we recommended in March 2003, that the 

Secretary of Homeland Security and the Administrator of EPA jointly 

develop a comprehensive national strategy for chemical security that is 

both practical and cost effective. The strategy should, among other things, 

identify high-risk facilities and collect information on industry security 

preparedness. We also recommended that DHS and EPA develop a 

legislative proposal, in consultation with industry and other appropriate 

groups, to require these chemical facilities to expeditiously assess their 

vulnerability to terrorist attacks and, where necessary, require these 

facilities to take corrective action. At that time, DHS and EPA generally 

agreed with these recommendations. 

While EPA no longer has a key role in ensuring chemical facility security, 

DHS has taken steps to implement our recommendations. In February 

2005, DHS released its Interim National Infrastructure Protection Plan. 
Page 5 GAO-05-631T 

While we have not fully evaluated this plan, it outlines a risk management 

framework to guide future efforts to identify and protect critical 

infrastructure and defines the roles of federal, state, local, and tribal 

agencies and the private sector using elements of this framework. In 

addition, DHS is developing a strategic plan specifically for securing the 

chemical sector and has a number of efforts underway to help identify and 

mitigate chemical facilities’ vulnerabilities. We are evaluating DHS’ efforts 

and plans for improving chemical sector security in our ongoing review. 

In comments responding to our March 2003 report, DHS stated that 

voluntary efforts alone will not be sufficient to assure an appropriate level 

of security across the industry, and that, in the department’s view, every 

one of the approximately 15,000 RMP facilities nationwide should be 

required to perform comprehensive vulnerability assessments and take 

actions to reduce vulnerabilities. As part of our ongoing review for this 

Committee, we plan to obtain DHS’ current views on whether legislation is 

still necessary and, if so, the types of provisions the agency feels would 

best assist the nation’s chemical facilities in addressing their vulnerability 

to attack. 

The Homeland Security Act of 2002 established DHS and set forth its 

mission to, among other things, prevent terrorist attacks within the United 

States, reduce the vulnerability of the United States to terrorism, and 

minimize the damage and assist in the recovery from terrorist attacks that 

do occur within the United States. Following passage of the act, a 

December 2003 presidential directive states that DHS is responsible for 

coordinating the overall national effort to enhance the protection of the 

critical infrastructure and key resources of the United States. The 

Secretary of Homeland Security serves as the principal federal official to 

lead, integrate, and coordinate the implementation of efforts among 

federal departments and agencies, state and local governments, and the 

private sector to protect critical infrastructure and key resources. The 

directive identified the chemical sector as a critical infrastructure sector 

along with other sectors, including agriculture, banking and finance, 

defense industrial base, emergency services, energy, food, government, 

information and telecommunications, postal and shipping, public health, 

transportation, and water. Under this presidential directive, DHS is now 

the lead agency for the chemical infrastructure sector, a change from 

national strategies issued in July 2002 and February 2003, which named 

EPA as the lead federal agency. 

Background 
Page 6 GAO-05-631T 

The presidential directive emphasized those critical infrastructure and key 

resources that could be exploited to cause catastrophic health effects or 

mass casualties. Because many chemicals are inherently hazardous, the 

release of chemicals or the risk of contamination at chemical facilities 

poses a potential threat to public health and the economy. Under the Clean 

Air Act’s Risk Management Program provisions, EPA identified 140 toxic 

and flammable chemicals that, when present above certain threshold 

amounts, would pose the greatest risk to human health and the 

environment if released accidentally into the air. According to EPA, 

approximately 15,000 facilities in a variety of industries produce, use, or 

store one or more of these chemicals beyond threshold amounts in one or 

more processes (e.g., single or interconnected vessels or tanks). 

Before these functions were transferred to DHS by the Homeland Security 

Act of 2002, Justice was responsible for collecting information from the 

U.S. intelligence community, the FBI’s criminal investigations, other 

federal agencies, and the private sector about threats, including those 

involving chemicals. The Chemical Safety Information, Site Security and 

Fuels Regulatory Relief Act required Justice to review the vulnerability of 

chemical facilities to terrorist or criminal attack and report this 

information to the Congress.4

 Justice prepared and submitted an interim 

report to Congress in May 2002 based on observations made at 11 

chemical manufacturing facilities. 

Experts agree that the nation’s chemical facilities present an attractive 

target for terrorists intent on causing massive damage. Many facilities 

house toxic chemicals that could become airborne and drift to 

surrounding communities if released or could be stolen and used to create 

a weapon capable of causing harm. Justice has been warning of the 

terrorist threat to chemical facilities for a number of years and has 

concluded that the risk of an attempt in the foreseeable future to cause an 

industrial chemical release is both real and credible. Based on analysis of 

trends in international and domestic terrorism and the burgeoning interest 

in weapons of mass destruction among criminals and terrorists, Justice 

warned of potential targeting by terrorists of chemical facilities before the 

events of September 11, 2001. In fact, according to Justice, domestic 

terrorists plotted to use a destructive device against a U.S. facility that 

housed millions of gallons of propane in the late 1990s. In testimony on 

 4

Pub. L. No. 106-40, 113 Stat. 207 (1999). 

Experts Agree that 

Chemical Facilities 

Are an Attractive 

Target for Terrorists 
Page 7 GAO-05-631T 

February 6, 2002, the Director of the Central Intelligence Agency also 

warned of the potential for an attack by al Qaeda on chemical facilities. 

Terrorist attacks involving the theft or release of certain chemicals could 

have a significant impact on the health and safety of millions of 

Americans. The disaster at Bhopal, India in 1984, when methyl isocyanate 

gas—a highly toxic chemical—leaked from a tank, reportedly killing about 

3,800 people and injuring anywhere from 150,000 to 600,000 others, 

illustrates the potential threat to public health from a chemical release. 

While U.S. chemical facilities are subject to a number of safety 

requirements, the Army has estimated high potential damage to the U.S. 

population from an intentional toxic chemical release. During a 2001 

informal meeting with a number of agencies, the Army Office of the 

Surgeon General proposed, based on generic estimates, that it was 

conceivable that as many as 2.4 million people could request medical 

treatment if a terrorist caused the release of a toxic chemical.5

 According 

to officials from that office, these estimates include anyone who seeks 

medical attention as a result of the release—including people with minor 

irritations or concerns. Similarly, a 2002 Brookings Institution report ranks 

an attack on toxic chemical plants behind only biological and atomic 

attacks in terms of possible fatalities.6

 In January 2005 testimony before 

the Senate Committee on Homeland Security and Governmental Affairs on 

challenges facing DHS, a Brookings Institution Visiting Fellow identified 

chemical facility security as a priority for DHS, noting that toxic industrial 

chemicals present the potential for mass casualties from a terrorist attack 

that is rivaled only by improvised nuclear devices, certain acts of 

bioterrorism, and the collapse of large, occupied buildings.7

In addition to the potential loss of life, a terrorist attack on a chemical 

facility could also disrupt the local or regional economy or impact other 

critical infrastructures. The chemical manufacturing industry produces the 

chemicals used in agriculture, pharmaceuticals, drinking water and 

 5

U.S. Army, Draft Medical NBC Hazard Analysis of Chemical-Biological-RadiologicalNuclear-High Explosive Threat, Possible Scenarios & Planning Requirements, Army 

Office of the Surgeon General (October 2001). 

6

The Brookings Institution, Protecting the American Homeland: A Preliminary Analysis, 

(Washington, D.C.: 2002). 

7

Statement of Richard A. Falkenrath, Visiting Fellow, The Brookings Institution, before the 

United States Senate Committee on Homeland Security and Governmental Affairs (January 

26, 2005). 
Page 8 GAO-05-631T 

wastewater treatment systems, and food processing. DHS’ February 2005 

Interim National Infrastructure Protection Plan notes that many critical 

infrastructure assets are dependent on multiple elements and systems to 

remain functional. In some cases, a failure in one sector will have a 

significant impact on the ability of another sector to perform necessary 

functions. For example, rail transportation of many hazardous materials 

including chlorine was disrupted in some states following the events of 

September 11, 2001, because of concern about the potential for an 

intentional chemical release. This disruption to rail service impacted 

drinking water facilities that relied on chlorine delivered by rail to purify 

water. 

Currently, no one has comprehensively assessed security across the nation 

at facilities that house chemicals. Both EPA and DHS officials have visited 

some chemical facilities to discuss security since September 11, 2001, but 

the results of these visits are not publicly available. EPA visited 30 highrisk chemical facilities to discuss security, and DHS has visited a number 

of chemical facilities to assist owner/operators in assessing vulnerabilities 

at their facilities. During a limited review of chemical industry 

vulnerabilities conducted at 11 facilities primarily before September 11, 

2001, Justice found that some chemical facilities may need to implement 

more effective security systems and develop alternative means to reduce 

the potential consequences of a successful attack. The effectiveness of 

security at some facilities may also be in doubt as evidenced by several 

media accounts of reporters and environmental activists gaining access to 

chemical tanks and computer centers that control manufacturing 

processes at facilities in 2001, 2002, and 2003. 

DHS has not yet determined the number and type of facilities that should 

be considered as part of the chemical infrastructure sector. The universe 

of chemical facilities is diverse in that they produce, use or store a host of 

products, including (1) basic chemicals used to manufacture other 

products such as fertilizers, plastics, and synthetic fibers; (2) specialty 

chemicals used for a specific purpose such as a functional ingredient or a 

processing aid in the manufacture of a range of products such as adhesives 

and solvents, coatings, industrial gases and cleaners, and water 

management chemicals; (3) life science chemicals consisting of 

pharmaceuticals and pesticides; and (4) consumer products such as hair 

and skin products and cosmetics. In total, about 15,000 RMP facilities 

produce, use, or store more than threshold amounts of one or more of the 

140 toxic and flammable chemicals that EPA has estimated pose the 

greatest risk to human health and the environment if accidentally released 

Chemical 

Infrastructure Sector 

Includes Many Types 

of Facilities with 

Different Risks 
Page 9 GAO-05-631T 

into the air. Approximately 4,000 facilities manufacture these chemicals, 

and numerous other types of facilities—agricultural suppliers such as 

fertilizer facilities, food storage facilities, pulp and paper manufacturers, 

iron and steel mills, and computer manufacturing facilities—also house 

large quantities of chemicals. While the universe of chemical facilities is 

diverse, some of these facilities are part of other critical infrastructure 

sectors. For example, about 2,000 of these facilities are community water 

systems that are part of the water infrastructure sector. 

Some facilities may be at higher risk of a terrorist attack than others 

because of the chemicals they house and their proximity to population 

centers. Toxic chemicals such as chlorine and ammonia could form a toxic 

cloud and drift over neighboring populations if released, while flammable 

chemicals such as butane and hydrogen could be used in destructive 

devices. Assuming that the objective of an attack is a catastrophic release 

of a toxic chemical, attacks on such facilities could harm a large number 

of people with health effects ranging from mild irritation to death. No 

specific data are available on what the actual effects of successful terrorist 

attacks on chemical facilities would be. However, RMP facilities submit to 

EPA estimates of the potential consequences to surrounding communities 

of hypothetical “worst-case” accidental chemical releases from their 

facilities. These estimates include the residential population located within 

the range of a toxic gas cloud produced by a “worst-case” chemical 

release, called the “vulnerable zone.” According to 2003 EPA data, 123 

chemical facilities located throughout the nation had toxic “worst-case” 

scenarios where more than one million people would be in the “vulnerable 

zone” and could be at risk of exposure to a cloud of toxic gas.8

 About 600 

facilities could each potentially threaten between 100,000 and a million 

people, and about 2,300 facilities could each potentially threaten between 

10,000 and 100,000 people within these facilities’ “vulnerable zones.” 

 8

“Vulnerable zones” are determined by drawing a circle around a facility with the radius of 

the circle equal to the distance a toxic gas cloud would travel before dissipating to 

relatively harmless levels. Because, in an actual event, the toxic cloud would only cover a 

fraction of that circle, it is unlikely that the event would actually result in exposure of the 

entire population estimated in the “worst-case” scenario, according to EPA. The number of 

persons within a “vulnerable zone” is larger than the number of persons that would be 

affected by a “worst-case” scenario. In addition, EPA’s requirements for “worst-case” 

release analysis tend to result in consequence estimates that are significantly higher than 

what is likely to actually occur. For example, “worst-case” release analysis does not take 

into account active mitigation measures facilities often employ to reduce the consequences 

of releases. 
Page 10 GAO-05-631T 

According to EPA and DHS, the method for calculating “worst-case” 

scenario calculations for RMP facilities overstates the potential 

consequences of a chemical release. The scenarios do not consider the 

potential causes of a release or how different causes or other 

circumstances, such as safety features, could lessen the consequences of a 

release. Furthermore, the scenarios’ “vulnerable zones” include the 

population in the entire area surrounding the facility, while the wind 

would typically carry the toxic cloud in one direction affecting only a 

portion of the area. While officials believe these scenarios are overstated, 

there are situations where an attack could result in larger consequences. 

EPA regulations require RMP facilities to estimate the effects of a toxic 

chemical release involving the greatest amount of the toxic chemical held 

in a single vessel or pipe, rather than the entire quantity on site. Therefore, 

for some facilities, an attack could breach multiple chemical vessels 

simultaneously and could result in a larger release with potentially more 

severe consequences than estimated in the “worst-case” scenario. 

Currently, few federal requirements address security at U.S. chemical 

facilities. While some chemical facilities must comply with the Public 

Health Security and Bioterrorism Response Act of 2002 (Bioterrorism Act) 

and the Maritime Transportation Security Act of 2002 (MTSA), many are 

not subject to any federal security requirements. The Bioterrorism Act 

requires community water systems serving more than 3,300 people to 

perform vulnerability analyses of their facilities, among other things. Many 

of these facilities may store hazardous chemicals for water treatment and 

are not required to implement any risk reduction actions based on their 

vulnerability assessments or report to EPA on measures that have been 

implemented. EPA estimated in 2003, that approximately 2,000 RMP 

facilities may be community water systems covered under the 

Bioterrorism Act. MTSA and its implementing regulations require maritime 

facility owners and operators to conduct assessments of certain at-risk 

facilities to identify vulnerabilities, develop security plans to mitigate these 

vulnerabilities, and implement the measures discussed in the security 

plans. According to the Coast Guard, 238 chemical facilities are located on 

waterways and handle “bulk liquid chemicals” are subject to MTSA 

requirements. 

The remaining chemical facilities, including the approximately 13,000 RMP 

facilities, are subject to no federal requirements specifically related to 

improving security against terrorist attacks. Although these facilities pose 

different levels of risk depending on the chemicals they use or store, 

thousands house quantities of toxic chemicals that could impact 

Few Federal 

Requirements 

Address Security at 

the Nation’s Chemical 

Facilities 
Page 11 GAO-05-631T 

neighboring populations if released. The security requirements for the 

chemical sector stand in contrast to a number of other critical 

infrastructure sectors that are subject to federal security requirements. In 

addition to community water systems, all commercial nuclear power 

plants licensed by the Nuclear Regulatory Commission are subject to a 

number of security requirements, including placing physical barriers 

outside the operating reactor area, limiting access to vital areas, 

maintaining a trained security force, and conducting simulated terrorist 

attack exercises. 

While the federal government does not require all chemical facilities to 

take security measures to protect against a terrorist attack, it does impose 

safety and emergency response requirements on chemical facilities, which 

may incidentally reduce the likelihood and mitigate the consequences of 

terrorist attacks. For example, the Emergency Planning and Community 

Right to Know Act requires owners and operators of facilities that 

maintain specified quantities of certain extremely hazardous chemicals to 

annually submit information on their chemical inventory to state and local 

emergency response officials. This information is used to help prepare 

community response plans in the event of a chemical incident. Under 

Section 112(r) of the Clean Air Act, EPA’s Risk Management Program 

requires owners and operators of facilities that handle listed extremely 

hazardous substances over a threshold amount to prepare and implement 

a risk management plan to detect and prevent or minimize accidental 

releases. In addition to evaluating “worst-case” accidental release 

scenarios, facility owners and operators must implement a program to 

prevent accidental releases that includes safety precautions and 

maintenance, monitoring, training measures, and must have an emergency 

response plan. The Department of Labor’s Occupational Safety and Health 

Administration’s process safety management standard also requires 

facilities to assess and address the hazards of their chemical process. 

These requirements could potentially mitigate a terrorist attack by (1) 

providing an incentive to facilities to reduce or eliminate chemicals below 

regulated threshold levels, (2) requiring facilities to implement measures 

to improve the safety of areas that are vulnerable to a chemical release, 

and (3) facilitating emergency response planning that increases 

preparedness for a chemical release—whether intentional or 

unintentional. 
Page 12 GAO-05-631T 

The federal government and the chemical industry have taken a number of 

steps to enhance security at chemical facilities. DHS’ Information Analysis 

and Infrastructure Protection Directorate has a number of initiatives 

underway to develop a strategy for protecting the chemical sector, identify 

high-risk facilities, and integrate chemical sector protection efforts into a 

national program. In February 2005, DHS released an Interim National 

Infrastructure Protection Plan. While we have not yet fully evaluated this 

plan, it outlines a risk management framework to guide future efforts to 

identify and protect critical infrastructure and defines the roles of federal, 

state, local, and tribal agencies and the private sector. DHS is also 

developing a vulnerability and risk assessment methodology designed to 

assist facilities with analyzing security, help DHS rank these facilities by 

risk, and allow DHS to compare assets across sectors.9

Without specific authority to require that chemical facilities make security 

improvements, DHS has worked voluntarily with the chemical industry to 

provide financial assistance, share information about critical 

infrastructure protection, provide training and exercises, and assess 

facility vulnerabilities and recommend security improvements. DHS has 

provided training programs to first responders and facility security officers 

and held drills at chemical facilities. DHS has also provided advice and 

guidance to state and local partners to reduce vulnerabilities in buffer 

zones (the area extending from the facility to the surrounding community) 

and conducted site assistance visits. 

The chemical sector, led by its industry associations, also has voluntary 

initiatives underway at member facilities. Industry associations have 

issued security guidance, identified security best practices, and developed 

vulnerability assessment methodologies specific to their members. In 

addition, industry is assisting DHS in developing a methodology for 

assessing risk in the chemical sector. To provide a mechanism for 

coordinating with DHS, in June 2004, the chemical industry established the 

Chemical Sector Council to identify, prioritize, and coordinate the 

protection of the industry’s critical infrastructure and key resources, and 

to facilitate the sharing of information about physical and cyber threats, 

vulnerabilities, incidents, potential protective measures, and best 

 9

DHS is developing this methodology—called the Risk Analysis and Management for 

Critical Asset Protection (RAMCAP)—in conjunction with the American Society of 

Mechanical Engineers. 

Federal Government 

and Industry Have 

Taken Steps to 

Improve Facility 

Security, but Further 

Action Is Needed 
Page 13 GAO-05-631T 

practices. The Council is composed of 16 sector associations representing 

a range of chemical facilities.10

The primary security initiative undertaken by the industry directs 

participating chemical facilities to assess vulnerabilities and develop 

security plans to address them. In this regard, the American Chemistry 

Council (ACC)—whose members own or operate approximately 1,000 (or 

about 7 percent) of the 15,000 RMP facilities—requires its members to 

perform vulnerability assessments, develop plans to mitigate 

vulnerabilities, and take actions to implement the plans.11 Companies are 

then required to have third parties such as local emergency responders or 

local law enforcement officials verify that physical security enhancements 

identified in facility plans were implemented. These third parties are not 

required, however, to verify that the vulnerability assessment is 

appropriately conducted and that the actions taken by the facility 

adequately address security risks. 

ACC also has a new requirement that independent auditors certify that 

member companies have management systems in place. These audits will 

confirm that companies have security programs and processes. According 

to ACC, all of its members have conducted vulnerability assessments, and 

most have completed security enhancements and had them verified. The 

Synthetic Organic Chemical Manufacturers Association (SOCMA), which 

represents manufacturers who produce specialty chemicals at small- to 

medium-sized facilities, also adopted these security requirements for all of 

their member facilities, which include 77 of the 15,000 RMP facilities.12

 10As of April 2005, Chemical Sector Council members included the American Chemistry 

Council, the American Forest and Paper Association, the Chemical Producers and 

Distributors Association, the Chlorine Chemistry Council, the Compressed Gas 

Association, CropLife America, the Institute of Makers of Explosives, the International 

Institute of Ammonia Refrigeration, the National Association of Chemical Distributors, the 

National Paint and Coatings Association, the National Petrochemical and Refiners 

Association, the Synthetic Organic Chemical Manufacturers Association, the Adhesive and 

Sealant Council, the Chlorine Institute, the Fertilizer Institute, and the Society of the 

Plastics Industry, Inc. 

11ACC adopted a security code to accompany its Responsible Care Management System®, a 

voluntary program to achieve improvements in environmental, health, and safety 

performance through management practices addressing a range of business activities. 

Member companies must comply with Responsible Care® requirements as a condition of 

membership. 

12SOCMA has 160 member companies. Thirty-six of these companies are also members of 

ACC and follow the Responsible Care® requirements.. The remaining 124 SOCMA member 

companies operate 273 facilities—of which 77 are RMP facilities. 
Page 14 GAO-05-631T 

ACC and SOCMA’s self-initiated membership requirements incorporate 

elements of a risk management framework, which can aid in assessing risk 

by determining which vulnerabilities should be addressed in what ways 

within available resources, and were designed to strengthen security at 

facilities that comply with its requirements. The actions required by 

Responsible Care® may exceed efforts taken by non-participating 

facilities. 

Despite these efforts, the overall extent of security preparedness at 

chemical facilities is unknown. While DHS has a number of programs 

underway to identify high-risk facilities and assess their vulnerabilities, 

these programs are in their infancy. As a result, neither DHS nor any other 

federal entity has yet assessed the overall extent of security preparedness 

at the nation’s chemical facilities. While chemical industry associations 

have worked closely with member companies to evaluate and improve 

security at facilities, the extent of participation in voluntary initiatives is 

unclear. EPA officials estimated in 2003, that voluntary initiatives led by 

industry associations only reach a portion of the 15,000 RMP facilities. 

Further, EPA and DHS have stated publicly that voluntary efforts alone are 

not sufficient to assure the public of the industry’s preparedness. In this 

context, a comprehensive national chemical security strategy that would, 

among other actions, identify high-risk facilities and require facilities to 

assess their vulnerabilities and take any needed corrective actions would 

help to ensure that security vulnerabilities at chemical facilities are 

addressed. 

Across the nation, thousands of industrial facilities manufacture, use, or 

store hazardous chemicals in quantities that could potentially put large 

numbers of Americans at risk of injury or death in the event of a chemical 

release. Experts agree that chemical facilities are an attractive target to 

terrorists because of the potential to harm large numbers of people and 

disrupt the economy or other critical infrastructures. Yet, despite efforts 

since September 11, 2001, to protect the nation from terrorism, the extent 

of security preparedness at U.S. chemical facilities is unknown. While 

some other critical infrastructures are required to assess their 

vulnerabilities, no federal requirements are in place to require all chemical 

facilities to assess their vulnerabilities and take steps to reduce them. Both 

the federal government and the chemical industry have taken steps to 

improve security at chemical facilities. However, these efforts have not 

involved all facilities with significant quantities of hazardous chemicals on 

site. Further action is needed to ensure that the nation’s chemical 

facilities—which produce, use, and store chemicals vital to the 

Conclusions 
Page 15 GAO-05-631T 

manufacture of a range of everyday products—are assessing security 

vulnerabilities and taking actions to address them. 

Madame Chairman, this concludes our prepared statement. We would be 

happy to respond to any questions that you or Members of the Committee 

may have. 

For further information about this testimony, please contact me at (202) 

512-3841. Jill Edelson, Joanna Owusu, Debra B. Sebastian, Amy Webbink, 

Leigh White, and Vincent P. Price made key contributions to this 

statement. 

Contacts and 

Acknowledgments 

(360581) 
This is a work of the U.S. government and is not subject to copyright protection in the 

United States. It may be reproduced and distributed in its entirety without further 

permission from GAO. However, because this work may contain copyrighted images or 

other material, permission from the copyright holder may be necessary if you wish to 

reproduce this material separately. 
The Government Accountability Office, the audit, evaluation and 

investigative arm of Congress, exists to support Congress in meeting its 

constitutional responsibilities and to help improve the performance and 

accountability of the federal government for the American people. GAO 

examines the use of public funds; evaluates federal programs and policies; 

and provides analyses, recommendations, and other assistance to help 

Congress make informed oversight, policy, and funding decisions. GAO’s 

commitment to good government is reflected in its core values of 

accountability, integrity, and reliability. 

The fastest and easiest way to obtain copies of GAO documents at no cost 

is through GAO’s Web site (www.gao.gov). Each weekday, GAO posts 

newly released reports, testimony, and correspondence on its Web site. To 

have GAO e-mail you a list of newly posted products every afternoon, go 

to www.gao.gov and select “Subscribe to Updates.” 

The first copy of each printed report is free. Additional copies are $2 each. 

A check or money order should be made out to the Superintendent of 

Documents. GAO also accepts VISA and Mastercard. Orders for 100 or 

more copies mailed to a single address are discounted 25 percent. Orders 

should be sent to: 

U.S. Government Accountability Office 

441 G Street NW, Room LM 

Washington, D.C. 20548 

To order by Phone: Voice: (202) 512-6000 

TDD: (202) 512-2537 

Fax: (202) 512-6061 

Contact: 

Web site: www.gao.gov/fraudnet/fraudnet.htm 

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470 

Gloria Jarmon, Managing Director, JarmonG@gao.gov (202) 512-4400 

U.S. Government Accountability Office, 441 G Street NW, Room 7125 

Washington, D.C. 20548 

Paul Anderson, Managing Director, AndersonP1@gao.gov (202) 512-4800 

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, D.C. 20548 

GAO’s Mission 

Obtaining Copies of 

GAO Reports and 

Testimony 

Order by Mail or Phone 

To Report Fraud, 

Waste, and Abuse in 

Federal Programs 

Congressional 

Relations 

Public Affairs 

PRINTED ON RECYCLED PAPER