ACTIONS NEEDED TO ENHANCE 

PIPELINE SECURITY 

Pipeline and Hazardous Materials Safety Administration 

Report Number: AV-2008-053 

Date Issued: May 21, 2008 
U.S. Department of 

Memorandum

Transportation 

Office of the Secretary 

of Transportation 

Office of Inspector General 

Subject: ACTION: Actions Needed To Enhance 

Pipeline Security 

Pipeline and Hazardous Materials 

Safety Administration 

Report Number AV-2008-053 

Date: May 21, 2008 

From: Lou E. Dixon 

Assistant Inspector General 

 for Aviation and Special Program Audits 

Reply to 

Attn. of: JA-10 

To: Pipeline and Hazardous Materials 

 Safety Administrator 

This report presents the results of our review on multi-agency actions to 

implement the pipeline security annex to the Memorandum of Understanding 

(MOU) between the Department of Transportation (DOT) and Department of 

Homeland Security (DHS). The Pipeline Inspection, Protection, Enforcement, and 

Safety Act of 20061

 requires the Office of Inspector General to assess actions 

taken to implement the annex. 

Consistent with the act, our audit objectives were to: (1) assess the adequacy and 

effectiveness of the process by which DOT communicates and coordinates with 

DHS on matters of pipeline security; (2) assess the agencies’ status in 

implementing the program elements outlined in the annex; and (3) review the role, 

responsibility, and authority of DOT regarding pipeline security matters. We 

conducted this review between June and November of 2007 in accordance with 

generally accepted Government Auditing Standards as prescribed by the 

Comptroller General of the United States. Exhibit A details our objectives, scope 

and methodology, and related audits. Exhibit B outlines the program elements in 

the annex. 

 

1

 Pub. L. No. 109-468 (2006). 
2

SECURING THE NATION’S PIPELINE SYSTEMS IS A 

CONTINUING CHALLENGE 

The Nation’s pipeline infrastructure is a network of approximately 2 million miles 

of pipelines that move millions of gallons of hazardous liquids and billions of 

cubic feet of natural gas daily. Within the United States, there are about 

2,200 natural gas pipeline operators and 300 hazardous liquids pipeline operators. 

DOT’s Pipeline and Hazardous Materials Safety Administration (PHMSA) is 

responsible for overseeing the safety of the Nation’s pipeline system. The 

Transportation Security Administration (TSA) within DHS is responsible for 

securing the Nation’s transportation infrastructure, including pipelines. 

Safeguarding the Nation’s massive pipeline infrastructure from catastrophic events 

(i.e., terrorism or natural disasters) is a continuing challenge for DOT and DHS. 

In 2005, Hurricane Katrina devastated the Gulf Coast region and demonstrated the 

vulnerabilities of the Nation’s critical infrastructure. Loss of electrical power to 

pumping stations forced three major pipeline operators to shut down. This 

eliminated most fuel sources to the entire eastern seaboard and caused a vast array 

of economic disruptions, including hoarding and severe price spikes. 

It should be noted that the most frequently targeted mode of transportation by 

terrorists worldwide is pipeline systems. In Colombia, for example, rebels have 

bombed the Caño Limón oil pipeline over 600 times since 1995. Terrorist plots 

against pipelines have also occurred within the United States. 

• In December 1999, Federal agents arrested two anti-government militia 

members for plotting to detonate 24 million gallons of liquid propane at a 

storage facility in Elk Grove, California. 

• In June 2007, the U.S. Department of Justice arrested members of a terrorist 

group planning to attack jet fuel pipelines and storage tanks at the John F. 

Kennedy (JFK) International Airport in New York. 

• In November 2007, a U.S. citizen was sentenced to 30 years in Federal prison 

for plotting to help an alleged al-Qaeda operative blow up U.S. oil pipelines 

and refineries. 

In addition, pipeline incidents can have deadly implications, such as the 

August 19, 2000, natural gas transmission pipeline (30-inch-diameter) that 

ruptured adjacent to the Pecos River near Carlsbad, New Mexico. The released 

gas ignited and burned for 55 minutes. Twelve people who were camping under a 

concrete-decked steel bridge that supported the pipeline across the river were 

killed, and their three vehicles were destroyed. Two nearby steel suspension 

bridges for gas pipelines crossing the river were also extensively damaged. 
3

These events underscore the need for a well-defined, well-coordinated, 

interagency approach to prevent, detect, and respond to such events. As we have 

stated in our DOT Top Management Challenges reports,2

 there is growing 

interdependency between DOT and other Federal agencies to ensure safe, secure, 

and efficient transportation. This is most evident in the responsibility to protect 

the public from criminal and terrorist acts, particularly in DOT’s working 

relationship with DHS. 

In today’s constrained fiscal environment, DOT and DHS must leverage their 

resources to secure the Nation’s pipelines. TSA’s pipeline security program—

with just 11 personnel—has the biggest challenge to effectively oversee the vast 

network of natural gas and hazardous liquids pipeline operators. Although 

PHMSA has regional offices and about 80 inspectors nationwide, it partners with 

state agencies—which have over 400 inspectors—to oversee and enforce 

compliance with pipeline safety requirements, primarily operators of natural gas 

distribution pipeline systems. Thus, it is incumbent upon PHMSA, TSA, and their 

state partners to effectively work together to enhance the security of the Nation’s 

pipeline infrastructure. 

Congress continues to emphasize the importance of securing the Nation’s 

pipelines and related infrastructure. On August 3, 2007, the President signed into 

law the Implementing Recommendations of the 9/11 Commission Act of 2007 

(9/11 Commission Act).3

 The law mandates, by 1 year after enactment, that the 

Secretary of Homeland Security and the Secretary of Transportation develop and 

implement a plan to review and inspect the 100 most critical pipeline operators’ 

pipeline security plans and critical facilities. 

RESULTS IN BRIEF 

We found that PHMSA and TSA have taken initial steps toward formulating an 

action plan to implement the provisions of the pipeline security annex, which are 

important to enhance pipeline security, clearly define roles, maximize resources, 

and prevent duplication of effort. However, further actions need to be taken with 

a sense of urgency because the current situation is far from an “end state” for 

enhancing the security of the Nation’s pipelines. 

In September 2004, DOT and DHS entered into an MOU to facilitate the 

development and deployment of transportation security measures. In August 

2006, PHMSA and TSA signed an annex to the MOU to establish clear lines of 

authority and responsibility over pipeline security matters. To accomplish this, the 

2

 OIG Report Number PT-2006-007, “DOT’s FY 2006 Top Management Challenges,” November 15, 2005, and OIG 

Report Number PT-2005-008, “DOT’s FY 2005 Top Management Challenges,” November 15, 2004. OIG reports 

are available on our website: www.oig.dot.gov. 3

 Pub. L. No. 110-53 (2007). 
4

annex requires PHMSA and TSA to jointly develop an action plan by February 

2007 to implement the annex provisions and program elements. Some program 

elements of the annex include identifying critical infrastructure and key resources; 

performing risk assessments; strategic planning; developing regulations, 

guidelines and directives; and conducting inspection and enforcement actions. 

PHMSA and TSA established a joint working group tasked with developing a 

multi-year action plan to execute the annex provisions and program elements. 

However, PHMSA and TSA have neither finalized the action plan to implement 

the annex nor initiated key program elements due to a working relationship that 

was not always cooperative. Both PHMSA and TSA agreed that they did not 

always coordinate their efforts in a collegial manner. 

Beginning in the second half of 2007, PHMSA and TSA began improving their 

coordination to address the annex provisions and program elements. For example, 

PHMSA created and staffed a new management position within the Office of the 

PHMSA Administrator. This manager is responsible for all aspects of PHMSA’s 

emergency management and security policy activities and reports directly to the 

Chief Safety Officer. This individual will also liaison with other agencies, 

including TSA and other stakeholders, regarding emergency management and 

security policy issues. 

To further enhance the security of the Nation’s pipeline infrastructure, PHMSA 

and TSA need to complete the following actions: 

Finalize and effectively execute the action plan to implement the security 

annex. PHMSA and TSA signed the annex 21 months ago, but the two agencies 

still have not finalized the action plan to fully implement the program elements of 

the annex—even though the deadline (February 2007) elapsed over a year ago. In 

December 2007, the agencies had not completed 9 of the 11 program elements, 

and the action plan did not contain several initiatives designed specifically to 

enhance coordination efforts. These include procedures to coordinate on 

observations or recommended measures from vulnerability assessments to 

determine if they conflict with current or planned safety requirements. 

Interagency coordination is essential to prevent the implementation of security 

recommendations that could inadvertently contradict safety regulations and put the 

safety of the Nation’s pipelines at risk. 

During the first 2 months of 2008, the two agencies began addressing outstanding 

annex program elements. PHMSA and TSA developed a new action plan, dated 

February 11, 2008, which estimates that most of the program element initiatives 

will be complete by the last quarter of 2009. While PHMSA and TSA have made 

progress toward finalizing the action plan, this progress began nearly a year after 

the completion deadline agreed to in the annex. Both agencies must sustain and 
5

expedite these collaborative efforts to finalize and effectively execute the annex 

provisions and program elements. 

Delineate roles and responsibilities in overseeing and enforcing security 

regulations for operators of liquid natural gas (LNG) facilities.4

 By law, TSA 

holds the lead authority and primary responsibility for security activities in all 

modes of transportation, including pipelines. TSA currently conducts reviews of 

pipeline operators’ compliance with TSA voluntary guidance5

 but does not have 

regulations related to pipeline security and does not take enforcement actions 

against pipeline operators. PHMSA has—and enforces—its own security 

regulations that existed prior to the creation of TSA in 2001. As a result, both 

agencies conduct reviews of LNG operators’ security procedures. PHMSA’s 

regulations have specific security requirements6

 for operators of LNG facilities, 

and PHMSA inspects LNG facilities to ensure that they meet those requirements. 

TSA has stated that it can issue security directives, but it has not done so. These 

directives would allow TSA to take enforcement actions against pipeline 

operators. 

Because the annex does not explicitly state which agency has primary oversight 

and enforcement authority for LNG operators, there is a lack of clearly defined 

roles at the working level. This could cause pipeline operators to receive 

conflicting or duplicative guidance, which will ultimately impede security 

measures. To resolve this issue, the annex should be amended to clearly delineate 

the roles and responsibilities of PHMSA and TSA in overseeing and enforcing 

security regulations for LNG operators. 

Maximize the strategy to assess pipeline operators’ security plans and 

guidance. The 9/11 Commission Act requires DOT and DHS to develop a plan to 

review the 100 most critical operators’ security plans and critical facilities by 

August 2008.7

 The act also requires that DOT and DHS issue security 

recommendations by February 2009 to operators of natural gas and hazardous 

liquids pipelines and pipeline facilities. The act also stipulates that if DHS 

determines that regulations are appropriate, it is required to consult with DOT. 

One of the two agencies shall then promulgate the regulations and perform 

necessary inspection and enforcement functions. The need for new security 

regulations will be partly determined by the degree to which pipeline operators are 

following TSA’s current security guidance. 

 

4

 LNG is natural gas cooled to an extremely low temperature, which causes it to liquefy. There are 113 LNG facilities 

in the United States. 5

 Following the events of September 11, 2001, PHMSA (formerly the Research and Special Programs Administration) 

developed voluntary pipeline security guidance in 2002, which TSA has since formally adopted. 6

 Liquefied Natural Gas Facilities: Federal Safety Standards, 49 C.F.R. § 193 (2007). 7

 PHMSA security guidance defines a facility’s critical categorization by three factors: (1) whether it is a viable 

terrorist target, (2) how important it is to the Nation’s energy infrastructure, and (3) how likely it is to be used as a 

weapon to harm people. 
6

However, TSA’s current security guidance is not mandatory and remains 

unenforceable unless a regulation is issued to require industry compliance. To 

adequately determine if new security regulations are needed, PHMSA and TSA 

will need to conduct covert tests of pipeline systems’ vulnerabilities to assess the 

current guidance as well as evaluate operators’ compliance. Until this is done, 

there is no way to effectively assess the adequacy of the security guidance or to 

measure operator compliance with the guidance. 

In our opinion, actions are needed from both PHMSA and TSA to maximize 

resources for assessing pipeline operators’ security plans and guidance. These 

actions should include: 

• Ensuring that PHMSA is actively involved in the inspections of the 100 most 

critical operators’ security plans and critical facilities. To date, PHMSA’s role 

has been limited to an “as needed” basis. According to PHMSA, it has not 

regularly attended past TSA security reviews of pipeline operators. To ensure 

effective and timely execution of this congressional mandate, PHMSA should 

participate in these inspections on a regular basis, especially given its level of 

expertise in security-related matters. 

• Developing testing protocols and performing vulnerability tests to ascertain, 

among other things, if unauthorized individuals can penetrate operators’ 

critical infrastructure (including cyber attacks). Currently, there are no plans to 

develop protocols and conduct vulnerability tests. Without testing, there is no 

way to effectively measure operators’ compliance with existing guidance or 

assess the adequacy of the guidance. 

PHMSA and TSA must work together to develop a pipeline security strategy that 

maximizes the value and efficiency of both agencies’ efforts. This is a 

fundamental factor in enhancing pipeline security. PHMSA must make every 

effort possible to communicate and coordinate with TSA to resolve the issues 

identified in this report. If PHMSA and TSA are unable to expedite the actions 

needed and improve coordination, it may be necessary for Congress to take action. 

Our complete recommendations are listed on page 12. PHMSA’s comments and 

our response are discussed on pages 13 and 14. 
7

FINDINGS 

PHMSA and TSA have taken initial steps toward formulating an action plan to 

implement the provisions of the annex; however, further actions are needed as the 

current situation is far from an “end state” for enhancing the security of the 

Nation’s pipeline system. After PHMSA and TSA signed the annex, they 

designated a joint working group to develop a multi-year action plan for 

implementing the provisions and program elements of the annex. The working 

group was to complete its efforts on developing the action plan by February 2007. 

Almost a year later, the working group developed a multi-year action plan, which 

identified many, but not all, of the initiatives and milestones to execute each 

program element. 

Based on our review, PHMSA and TSA need to complete the following actions to 

further enhance the security of the Nation’s pipeline infrastructure: (1) finalize and 

effectively execute the action plan for implementing the security annex, (2) amend 

the annex to delineate the roles and responsibilities of PHMSA and TSA in 

overseeing and enforcing security regulations for LNG operators, and 

(3) maximize the strategy used to assess pipeline operators’ security plans and 

guidance to ensure effective and timely execution of congressional mandates in 

the 9/11 Commission Act. 

PHMSA and TSA Need To Finalize and Effectively Execute the Action 

Plan for Implementing the Security Annex 

PHMSA and TSA signed the annex 21 months ago; yet, the two agencies have 

neither finalized the action plan to implement the annex program elements nor 

developed several initiatives. This has delayed key elements of the annex that 

were designed specifically to enhance communication and coordination efforts 

between the two agencies. For example, PHMSA and TSA have not developed an 

initiative to coordinate on observations or recommended measures from 

vulnerability assessments to determine if they conflict with current or planned 

safety requirements. This coordination is essential to prevent security 

recommendations that could unintentionally contradict safety regulations and put 

the safety of the Nation’s pipelines at risk. 

Towards the end of 2007, we found that the agencies had not completed 9 of the 

11 annex program elements because there are no deadlines to foster timely reviews 

and decision processes; further, the agencies are not held accountable for failure to 

abide by the annex provisions. Without interim deadlines and accountability, 

there is no guarantee the action plan will be finalized and properly executed. 
8

For example: 

• The December 2007 action plan to implement the annex did not contain some 

of the initiatives for program elements. For instance, the plan did not include 

certain items that the agencies agreed to in the annex, such as (1) an initiative 

for PHMSA to provide TSA with data and information collected during 

PHMSA’s security inspections or reviews of security plans, (2) protocols for 

ongoing information sharing and participation in their respective research and 

development planning, and (3) an initiative for TSA to coordinate with PHMSA 

on observations or recommended measures—derived from the results of criticality 

and vulnerability assessments—to evaluate whether they conflict with or 

adversely affect current or planned safety requirements. 

• PHMSA and TSA had not established target dates to complete some of the 

elements and element initiatives. Under the annex, PHMSA and TSA agreed 

to develop a plan with specific timeframes for implementing the program 

elements. For example, the December 2007 plan did not contain timeframes 

to: (1) develop a procedure for requesting special permits to install pipeline 

facilities in the event of a security incident, (2) provide training to TSA staff on 

technical issues related to PHMSA’s mission, or (3) perform a study on the 

petroleum pipeline network supply. 

• Some elements have future target dates that extend out to 2009 (we are 

concerned that PHMSA and TSA will not meet these deadlines, since they 

have been unable to finalize the action plan to execute the annex). 

During the first 2 months of 2008, the two agencies began addressing outstanding 

annex program elements. PHMSA and TSA developed a new action plan, dated 

February 11, 2008, which estimates that most of the program element initiatives 

will be complete by the last quarter of 2009. Also, the plan now contains 

initiatives for PHMSA to invite TSA to its security reviews of LNG facilities and 

for PHMSA and TSA to share security-related enforcement actions. However, the 

current action plan still does not contain initiatives (1) to develop protocols for 

ongoing information sharing and participation in the agencies’ respective research 

and development planning and (2) for TSA to coordinate with PHMSA on 

observations or recommended measures—derived from the results of criticality and 

vulnerability assessments—to evaluate whether they conflict with or adversely affect 

current or planned safety requirements. 

While PHMSA and TSA have made progress toward finalizing the action plan, 

this progress began nearly a year after the completion deadline agreed to in the 

annex. Both agencies must sustain and expedite these collaborative efforts to 

finalize and effectively execute the annex provisions and program elements. 
9

PHMSA and TSA Need To Delineate Their Roles and Responsibilities 

for Overseeing and Enforcing Security Regulations for Operators of 

LNG Facilities 

A central goal of the annex was to delineate clear lines of authority and prevent 

duplication of effort. Yet, the annex does not contain language that explicitly 

states which agency will be responsible overseeing and enforcing security 

regulations for operators of LNG facilities. Since both PHMSA and TSA can 

conduct reviews of LNG facilities, a clear line of authority does not exist. This 

creates the potential for duplicative efforts and confusion among LNG operators 

regarding which agency they should look to for guidance as the lead Federal 

security regulator. 

By law, TSA holds the lead authority and primary responsibility for security 

activities in pipelines. In practice, PHMSA’s role, responsibility, and authority in 

pipeline security include enforcing its LNG safety regulations (which include 

specific security requirements) that existed prior to the creation of TSA. Under 

PHMSA regulations, LNG facilities must have, among other things, a (1) security 

manual, (2) security training program for employees, (3) security communications 

system, and (4) security lighting and monitoring system. PHMSA inspects LNG 

facilities to ensure they are meeting these requirements. The LNG facilities 

regulations are the only PHMSA pipeline regulations that specifically delineate 

operators’ security responsibilities in detail. For hazardous liquid and gas 

pipelines, PHMSA has other pipeline safety regulations that require pipeline 

operators to prevent vandalism and unauthorized use of equipment. 

While PHMSA continues to oversee the security of LNG facilities, TSA has stated 

that it can issue security directives, but it has not done so. These directives would 

allow TSA to take enforcement actions against pipeline operators. TSA currently 

conducts reviews of pipeline operators’ compliance with voluntary guidance but 

does not have regulations related to pipeline security and does not take 

enforcement actions against pipeline operators. 

To further complicate the matter, the United States Coast Guard—a DHS agency 

responsible for marine and port security—also has authority to oversee and 

enforce its security regulations for operators of LNG facilities.8

 Several of the 

operators’ LNG facilities are located in the Nation’s ports or along its eastern 

seaboard. 

PHMSA, the U.S. Coast Guard, and the Federal Energy Regulatory Commission9

executed an interagency agreement in 2004 for safety and security reviews of 

 

8

 Maritime Security: Facilities, 33 C.F.R. § 105 (2007). 

9

 The Federal Energy Regulatory Commission is responsible for authorizing the site and construction of onshore LNG 

facilities and also conducts environmental, safety, and security reviews of LNG plants and related pipeline facilities. 
10

LNG facilities. The purpose of the agreement was, among other things, “to avoid 

duplication of effort and to maximize the exchange of relevant information related 

to the safety and security aspects of LNG facilities and the related marine 

concerns.” 

In our view, a similar approach should be taken with the pipeline security annex to 

resolve the issue of overlapping authority between PHMSA and TSA. The annex 

should be amended to specifically delineate the agencies’ roles and responsibilities 

in overseeing and enforcing security regulations for LNG operators. 

PHMSA and TSA Need To Maximize the Strategy Used To Assess 

Pipeline Operators’ Security Plans and Guidance 

Congress continues to emphasize the importance of securing the Nation’s 

pipelines and related infrastructure. In August 2007, Congress passed the 

Implementing Recommendations of the 9/11 Commission Act. The act mandates, 

among other things, the following actions related to pipeline security for the 

Secretary of Homeland Security and the Secretary of Transportation: 

• DHS, in consultation with DOT, is required to establish a program for 

reviewing pipeline operators’ adoption of recommendations in a 2002 PHMSA 

security guidance document. The PHMSA guidance recommended that, 

among other things, pipeline operators: (1) identify critical facilities, 

(2) develop and implement a corporate security plan, and (3) review the 

corporate security plan on an annual basis and revise as necessary to reflect 

changing conditions. The program must also include a plan to review pipeline 

security plans and critical facility inspections by May 2008. 

• DHS and DOT are required to develop and implement a plan for reviewing and 

inspecting the 100 most critical pipeline operators’ pipeline security plans and 

critical facilities.10 The agencies are required to develop and implement a plan 

by August 3, 2008. 

• DHS and DOT shall develop and transmit to pipeline operators security 

recommendations for natural gas and hazardous liquid pipelines and pipeline 

facilities by February 2009. 

• If DHS determines that regulations are appropriate, it is required to consult 

with DOT. One of the two agencies shall then promulgate the regulations and 

perform necessary inspection and enforcement functions. 

 

10 PHMSA security guidance defines a facility’s critical categorization by three factors: (1) whether it is a viable 

terrorist target, (2) how important it is to the Nation’s energy infrastructure, and (3) how likely it is to be used as a 

weapon to harm people. 
11

To determine whether additional security regulations are needed, PHMSA and 

TSA will need to evaluate and test the adequacy of existing security standards as 

agreed to under the annex. The need for new security regulations will be partly 

determined by the degree to which pipeline operators are following existing 

guidance. 

However, the current security guidance created by PHMSA, TSA, and pipeline 

industry associations is not mandatory and remains unenforceable unless a 

regulation is issued to require industry compliance. Further, the guidance is 

general in nature and only provides a broad overview of security issues in industry 

and effective policies and practices. To determine if new security regulations are 

needed, PHMSA and TSA will need to conduct covert tests of pipeline systems’ 

vulnerabilities to assess the current guidance as well as evaluate operators’ 

compliance. 

Although the Pipeline Inspection, Protection, Enforcement, and Safety Act of 

2006 also requests an assessment of TSA security guidance, we did not perform 

those activities for several reasons. To truly assess whether existing security 

guidance is adequate, we would have needed to: (1) evaluate operators’ 

compliance with the guidance; (2) develop testing protocols; and (3) perform 

vulnerability tests to ascertain, among other things, if unauthorized individuals can 

penetrate operators’ critical infrastructure. It is not within the DOT Office of 

Inspector General’s jurisdiction to perform such activities. We discussed these 

matters with the congressional committees of jurisdiction. 

Because PHMSA and TSA have reviewed pipeline operators’ compliance with 

security guidance in the past, these agencies would be best suited to evaluate this 

area. Therefore, it would be appropriate for PHMSA and TSA to collaborate in 

assessing whether existing security guidance is adequate. 

In our opinion, however, actions are needed from both PHMSA and TSA to 

maximize the strategy for assessing pipeline operators’ security plans and 

guidance. These actions should include the following: 

• Ensuring that PHMSA is actively involved in the inspections of the 100 most 

critical operators’ security plans and critical facilities. To date, PHMSA’s role 

has been limited to an “as needed” basis. According to PHMSA, it has not 

regularly attended past TSA security reviews of pipeline operators. To ensure 

effective and timely execution of this congressional mandate, PHMSA should 

participate in these inspections on a regular basis, especially given its level of 

expertise in security-related matters. 
12

• Developing testing protocols and performing vulnerability tests to ascertain, 

among other things, if unauthorized individuals can penetrate operators’ 

critical infrastructure (including cyber attacks). Currently, there are no plans 

to develop protocols and conduct vulnerability tests. Without testing, there is 

no way to effectively measure operators’ compliance with existing guidance or 

assess the adequacy of the guidance. 

PHMSA and TSA must work together to develop a pipeline security strategy that 

maximizes the value and efficiency of both agencies’ efforts. This is a 

fundamental factor in enhancing pipeline security. PHMSA must make every 

effort possible to communicate and coordinate with TSA to move forward in 

completing the actions identified in this report. If PHMSA and TSA are unable to 

expedite the actions needed and improve coordination, it may be necessary for 

Congress to take action. 

RECOMMENDATIONS 

PHMSA should make it a top management priority to finalize and execute the 

action plan for implementing the security annex and meet the deadlines mandated 

in the 9/11 Commission Act. Therefore, we recommend that the PHMSA 

Administrator collaborate with the TSA Administrator to complete the following 

actions: 

1. Finalize the action plan for implementing the annex provisions and program 

elements and effectively execute the action plan. 

2. Amend the annex to clearly delineate the roles and responsibilities of 

PHMSA and TSA in overseeing and enforcing security regulations for 

LNG operators. 

3. Maximize the strategy used to assess pipeline operators’ security plans and 

guidance to ensure effective and timely execution of congressional mandates 

in the 9/11 Commission Act. At a minimum, enhancements to the strategy 

need to include (a) actively engaging PHMSA assistance in inspecting the 

100 most critical pipeline operators’ pipeline security plans and critical 

facilities and (b) developing protocols and conducting vulnerability tests to 

effectively measure operators’ compliance with existing guidance or assess 

the adequacy of the guidance. 
13

AGENCY COMMENTS AND OFFICE OF INSPECTOR GENERAL 

RESPONSE 

On January 31, 2008, we provided PHMSA Headquarters officials with a 

preliminary draft and discussed our results with them. On February 1, 2008, we 

submitted our draft report to PHMSA and requested its formal comments. We 

subsequently met with PHMSA’s Chief Safety Officer to discuss her views on the 

issues presented in this report. We agreed to revise the draft as appropriate to 

include the Agency’s recent progress toward finalizing the action plan to fully 

implement the annex program elements. We provided PHMSA with our revisions 

on February 15, 2008. 

We received PHMSA’s formal response on March 7, 2008, which concurred with 

our recommendations and provided appropriate planned actions and target dates. 

• Recommendation 1: PHMSA stated it will continue to work with its TSA 

partners to regularly update and prioritize items on the action plan and then 

execute those items. Also, to improve accountability and management 

visibility, the action plan will be updated monthly and forwarded to PHMSA’s 

Chief Safety Officer for review. PHMSA’s actions taken to resolve this 

recommendation were effective as of March 7, 2008. 

• Recommendation 2: PHMSA stated it will work with TSA and the other 

agencies with which it has Memoranda of Understanding concerning LNG 

facilities to determine if further clarification of roles and responsibilities in 

oversight and enforcement of security regulations for affected LNG operators 

is warranted. PHMSA will also assist TSA in its communication and work 

with appropriate state agencies that have regulatory oversight of peakshaving11 LNG facilities. PHMSA will notify our office of this determination 

by June 30, 2008. 

• Recommendation 3: PHMSA stated that it will work closely with TSA to 

execute the pipeline mandates in the 9/11 Commission Act. Because 

PHMSA’s pipeline safety inspection resources are already committed for FY 

2008, it is unlikely to actively participate with TSA in the remaining 

inspections of the top 100 pipeline operators. However, PHMSA will work 

with TSA as it compiles and analyzes the results of the inspections to 

determine the extent to which operators voluntarily complied with 2002 

security standards. 

 

11 LNG peak-shaving facilities store surplus natural gas that is to be used to meet the requirements of peak 

consumption later during winter or summer. 
14

PHMSA also stated that it has little experience in covertly assessing the 

effectiveness of security plans and must defer to TSA for this expertise. 

Nonetheless, based on TSA’s inspections and vulnerability assessments, 

PHMSA will work with TSA to determine if the security standards and 

guidance adequately ensure the safety of the Nation’s pipeline facilities and 

whether security-focused regulations are needed. PHMSA’s actions taken to 

resolve this recommendation were effective as of March 7, 2008. 

PHMSA also provided several general comments, such as emphasizing that, as a 

matter of policy, it recognizes that TSA has primary responsibility for pipeline 

security and it is committed to support TSA’s leadership in these matters. 

PHMSA further emphasized recent actions taken to enhance communication and 

coordination between PHMSA and DHS, including the DOT Secretary and 

Deputy Secretary quarterly meetings with the DHS Secretary and Deputy 

Secretary to discuss interdepartmental issues and initiatives. PHMSA’s full 

response is included in the appendix to this report. 

We also provided TSA Headquarters officials with a copy of the draft report on 

February 8, 2008, and have incorporated their comments as appropriate. 

ACTIONS REQUIRED 

PHMSA’s response and planned actions address the intent of our 

recommendations. In accordance with the provisions of DOT Order 8000.1C, we 

will follow up with PHMSA to ensure its corrective actions are consistent with our 

recommendations. 

We appreciate the courtesies and cooperation of PHMSA and TSA representatives 

during this audit. If you have any questions concerning this report, please contact 

me at (202) 366-0500 or Scott Macey, Program Director, at (415) 744-0434. 

# 
15

EXHIBIT A. OBJECTIVES, SCOPE AND METHODOLOGY, AND 

RELATED AUDITS 

Objectives 

The Pipeline Inspection, Protection, Enforcement, and Safety Act of 2006 (Pub. L. 

No. 109-468 [2006]) directed the Office of Inspector General to review DOT’s 

actions to implement the pipeline security annex to the memorandum of 

understanding between DOT and DHS. Consistent with the act, our audit 

objectives were to: (1) assess the adequacy and effectiveness of the process by 

which DOT communicates and coordinates with DHS on matters of pipeline 

security; (2) provide the agencies’ status in implementing the program elements 

outlined in the annex; and (3) review the role, responsibility, and authority of DOT 

regarding pipeline security matters. 

Scope and Methodology 

We conducted the audit between June 2007 and November 2007 in accordance 

with generally accepted Government Auditing Standards prescribed by the 

Comptroller General of the United States. We included necessary tests to provide 

reasonable assurance of detecting abuse or illegal acts. 

To assess DOT’s process for communicating and coordinating with DHS on 

matters of pipeline security, we interviewed agency officials at PHMSA’s Office 

of Pipeline Safety and TSA’s Pipeline Security Division. We reviewed 

correspondence on pipeline security matters between the two agencies and various 

associated documents. 

To provide the agencies’ status in implementing the annex program elements, we 

interviewed officials at PHMSA’s Office of Pipeline Safety and TSA’s Pipeline 

Security Division to discuss actions taken and needed by the two agencies to 

implement the annex. We examined (1) the security annex between PHMSA and 

TSA to identify the roles and responsibilities between the two agencies, 

(2) provisions and program elements of the annex, and (3) the PHMSA/TSA 

action plan initiatives and target dates to implement the annex. 

Exhibit A. Objectives, Scope and Methodology, and Related Audits 
16

To determine the role, responsibility, and authority of PHMSA regarding pipeline 

security matters, we examined the following: 

• The Aviation Transportation and Security Act of 2001 (Pub. L. No. 107-71 

[2001]. 

• The Homeland Security Act of 2002 (Pub. L. No. 107-296 [2002]. 

• The Pipeline Inspection, Protection, Enforcement, and Safety Act of 2006. 

• The Implementing Recommendations of the 9/11 Commission Act of 2007 

(Pub. L. No. 110-53 [2007]). 

• Title 49 Code of Federal Regulations Parts 192, 193, and 195 pertaining to 

pipeline security operations. 

• Homeland Security Presidential Directives (HSPD) 5, “Management of 

Domestic Incidents,” HSPD 7, “Critical Infrastructure Identification, 

Prioritization, and Protection,” and HSPD 8, “National Preparedness.” 

We also interviewed agency officials at PHMSA’s Office of Pipeline Safety and 

TSA’s Pipeline Security division to obtain each agency’s perspective on the 

division of pipeline security roles, responsibilities, and authority. 

Although the Pipeline Inspection, Protection, Enforcement, and Safety Act of 

2006 also requests an assessment of TSA security guidance, we did not perform 

those activities for several reasons. To truly assess whether existing security 

guidance is adequate, we would have needed to: (1) evaluate operators’ 

compliance with the guidance; (2) develop testing protocols; and (3) perform 

vulnerability tests to ascertain, among other things, if unauthorized individuals can 

penetrate operators’ critical infrastructure. It is not within DOT’s Office of 

Inspector General’s jurisdiction to perform such activities. We discussed these 

issues with the congressional committees of jurisdiction. 

However, we did examine the 2002 Pipeline Security Information Circular, which 

PHMSA developed and TSA later adopted. We also examined the following: 

• “Security Guidelines - Natural Gas Industry - Transmission and Distribution,” 

developed by the Intrastate Natural Gas Association of America, the American 

Gas Association, and the American Public Gas Association 

• “Security Guidelines for the Petroleum Industry,” developed by the American 

Petroleum Institute. 

• TSA’s “Pipeline Security Smart Practices.” 

• Applicable laws and regulations. 

Exhibit A. Objectives, Scope and Methodology, and Related Audits 
17

We also interviewed representatives of the Interstate Natural Gas Association of 

America, the American Petroleum Institute, and the Association of Oil Pipeline to 

obtain their perspectives on the adequacy of Federal and industry pipeline security 

guidance. 

During the audit, we visited or spoke with (via telephone) representatives from 

PHMSA’s Eastern and Southwest regional offices to obtain their perspectives on 

field operations relating to pipeline security matters. We also visited five pipeline 

operators in Texas (Centerpoint Energy, ConocoPhillips, El Paso, Kinder Morgan, 

and Panhandle Energy); one pipeline operator in Virginia (Dominion); and one 

pipeline operator in California (Pacific Gas and Electric). At each location, we 

interviewed key program officials to obtain their perspectives on pipeline security 

matters and, where possible, toured their facilities. 

Related Audit and Testimony Coverage 

Report SC-2004-064, “Actions Taken and Needed for Improving Pipeline 

Safety,” June 15, 2004. We reported that, among other things, it was unclear 

which agency or agencies would be responsible for pipeline security rulemaking, 

oversight, and enforcement and recommended that the delineation of roles and 

responsibilities between DOT and DHS be defined by executing a Memorandum 

of Understanding or Memorandum of Agreement. 

Testimony CC-2004-055, “Actions Taken and Needed for Improving Pipeline 

Safety,” June 15, 2004. The OIG presented testimony before the Senate 

Committee on Commerce, Science, and Transportation regarding actions taken 

and needed for improving pipeline safety. We reported that, among other things, 

DOT’s Office of Pipeline Safety and TSA need to establish their respective 

pipeline security roles and responsibilities and then define them at the operational 

level. 

Testimony CC-2004-061, “Actions Taken and Actions Needed To Improve 

Pipeline Safety,” June 16, 2004. The OIG presented testimony to the House 

Committee on Transportation and Infrastructure, Subcommittee on Highways, 

Transit, and Pipelines regarding actions taken and needed for improving pipeline 

safety. We provided the same recommendation to the Senate Committee that we 

presented to the House Committee the previous day. 

Testimony CC-2004-071, “Progress and Challenges in Improving Pipeline 

Safety,” July 20, 2004. The OIG presented testimony before the House Energy 

and Commerce Committee, Subcommittee on Energy and Air Quality regarding 

progress and challenges in improving pipeline safety. We provided the same 

recommendation to the House Committee that we presented to the House 

Exhibit A. Objectives, Scope and Methodology, and Related Audits 
Exhibit A. Objectives, Scope and Methodology, and Related Audits 

18

Subcommittee on Highways, Transit, and Pipelines and the Senate Committee on 

Commerce, Science, and Transportation the previous month. 

Testimony CC-2006-023, “Pipeline Safety: Progress and Remaining 

Challenges,” March 16, 2006. The OIG presented testimony before the House 

Transportation and Infrastructure Committee, Subcommittee on Highways, 

Transit, and Pipelines regarding progress and remaining challenges in improving 

pipeline safety. We reported that the DOT’s Office of Pipeline Safety and TSA 

still need to define their roles and responsibilities at the operational level in an 

annex to the MOU. A lack of clearly defined roles among the Office of Pipeline 

Safety and TSA at the working level could lead to duplicative or conflicting 

efforts, less than effective intergovernmental relationship, and—most 

importantly—the potential for an uncoordinated response to a terrorist attack. 

Testimony CC-2006-039, “Pipeline Safety: Progress and Remaining 

Challenges,” April 27, 2006. The OIG presented testimony before the House 

Committee on Energy and Commerce Subcommittee on Energy and Air Quality 

regarding progress and remaining challenges in improving pipeline safety. We 

provided the same recommendation to the House Committee that we presented to 

the House Subcommittee on Highways, Transit, and Pipelines the previous month. 
19

EXHIBIT B. PROGRAM ELEMENTS IN THE PIPELINE SECURITY 

ANNEX 

Program Element Description 

1. Identification of Critical 

Infrastructure/Key Resources 

and Risk Assessments 

The agencies agreed to review existing definitions of criticality and 

consider the need to refine definitions. To support TSA efforts in this 

area, PHMSA agreed to provide compliance data, other information 

collected in the course of security inspections or reviews of security 

plans (including those required under 49 CFR 172.800), and activities 

of transportation carriers and shippers. 

Also, TSA will coordinate with PHMSA on observations or 

recommended measures derived from the results of criticality and 

vulnerability assessments, including on pipelines, to evaluate whether 

they conflict with or adversely affect current or planned safety 

requirements. 

2. Strategic Planning The agencies will seek consensus concerning measures to reduce risk 

and minimize consequences of emergencies involving pipeline 

infrastructure. Also, the agencies will identify initiatives and activities 

for achieving performance goals and will develop a program 

framework and timetable for their completion. 

3. Standards, Regulations, 

Guidelines, and Directives 

The agencies will seek early and frequent coordination in the 

development standards, regulations, guidelines, or directives affecting 

transportation security; identify best practices; and explore 

opportunities to build on existing standards-setting activities. In the 

course of discharging their safety and security missions, the agencies 

will review the adequacy of existing standards in the private and public 

sector, identifying any gaps that should be addressed through 

rulemaking, guidelines, or directives. 

4. Inspections and Enforcement The agencies will explore opportunities for collaboration in inspection 

and enforcement activities, with the objective of maximizing the use of 

available resources and targeting enforcement resources on the basis of 

system risks. The agencies will immediately develop procedures for 

referral of safety and security issues to PHMSA and TSA, respectively; 

inventory existing inspection and enforcement resources; and develop 

specific plans for closer coordination in the deployment and use of 

inspectors, including any necessary additional training. 

5. PHMSA Technical Support TSA can ask for PHMSA’s support to develop, staff, implement, or 

enforce regulations, orders, directives, plans, programs, or other 

measures. TSA can also ask for PHMSA support to conduct security 

reviews during an elevated security threat. 

6. Sharing Information During 

Emergency Response 

The agencies agreed to promptly share information about emergency 

situations that implicate the missions and interests of each other. 

Exhibit B. Program Elements in the Pipeline Security Annex 
Exhibit B. Program Elements in the Pipeline Security Annex 

20

7. Public Communication, 

Education, and Outreach 

The agencies will review existing protocols for public communication 

concerning security-related matters, specifically including review of 

existing protocols for publication of information contained in the 

national pipeline mapping system (a map of the Nation’s pipelines 

developed by PHMSA). 

8. Communicating Protective 

Measures to Affected 

Organizations 

The agencies agreed to consult with one another before disseminating 

security requirements, voluntary standards, and guidelines that impact 

security to the public. 

9. Research and Development The agencies will review their safety- and security-related projects and 

identify opportunities to collaborate and support their strategic plan 

through identification, development, and testing of new or modified 

technologies or processes. Also, the agencies will establish protocols 

for ongoing information sharing and participation in their respective 

research and development planning processes. 

10. Legislative Matters The agencies are to consult with each other as soon as possible on the 

development of proposed legislation, comments on legislative 

proposals, draft testimony or briefings to be given before congressional 

bodies or staff, and answers to questions for the record. 

11. Budget The agencies agreed to communicate throughout the budget 

development, justification, and execution process in order to develop 

and present a coordinated position on transportation security funding 

matters and to avoid duplicative requests for funding in connection 

with pipeline and hazardous material transportation security. 
21

APPENDIX. AGENCY COMMENTS 

U.S. Department 1200 New Jersey,S.E. 

of Transportation Washington, D.C. 20590 

Pipeline and Hazardous 

Materials Safety 

Administration 

March 07, 2008 

Mr. David A. Dobbs 

Principal Assistant Inspector General for Auditing and Evaluation 

Office of the Inspector General 

U.S. Department of Transportation 

1200 New Jersey Ave, SE 

Washington, DC 20590 

RE: OIG Project 07A3018A000 

Dear Mr. Dobbs: 

The Pipeline and Hazardous Materials Safety Administration (PHMSA) thanks the 

Department’s Office of Inspector General (OIG) for its efforts, reported in Project 

07A3018A000, to examine the complex issues of pipeline security; to interview a wide range 

of government and private sector stakeholders; and to render its opinions on areas of pipeline 

security that need improvement. This letter responds to the recommendations contained in 

that report. 

PHMSA, as a matter of policy, recognizes that the Transportation Security Administration 

(TSA) has primary responsibility for pipeline security. PHMSA is committed to support 

TSA’s leadership in these matters. The TSA/PHMSA Annex to the Department of 

Homeland Security (DHS), DHS/DOT Memorandum of Understanding identifies eleven 

Program Elements for TSA and PHMSA cooperation and collaboration to promote pipeline 

security. 

PHMSA has acknowledged TSA’s role in leading security inspections of pipeline operators 

and their facilities. PHMSA has, in large part, discontinued performing inspections of 

pipeline operators’ compliance with security protocols that would duplicate TSA’s 

inspections. We have no reports of overlapping or duplicative security inspections from 

pipeline operators. 

Appendix. Agency Comments 
22

BACKGROUND

PHMSA’s Pipeline Safety Program has always addressed the risks that security issues posed 

to safe operation of pipeline systems. Before 9/11, PHMSA addressed such risks by 

requiring operators to have plans and capabilities to protect pipeline facilities from vandalism 

and to facilitate response to foreseeable emergencies at their facilities. 

Early in 2002, PHMSA’s predecessor, the Research and Special Programs Administration (RSPA), 

worked with industry and State agencies, through the consensus standards process, to formulate 

consistent guidance for protecting Liquefied Natural Gas facilities, natural gas and hazardous liquid 

pipelines and their associated facilities. These guidelines identified protective actions that were 

scaled to the National Threat Advisory System levels. 

In Section 1557 of the 9/11 Commission Act (Pub. L. 110-53), the Congress directed TSA and 

PHMSA to collaboratively develop and implement security standards, assess their effectiveness, then 

evaluate if regulations are needed to ensure pipeline security. The MOU Annex and the Pipeline 

Security Action Plan uniformly shows TSA as the leader in each provision, with support, 

collaboration, and consultation from PHMSA. 

RECENT PHMSA ACTIONS

The following examples illustrate the enhanced communications and coordination between PHMSA 

and DHS that have been implemented in the past year. At the Departmental level, the Secretary and 

Deputy Secretary of Transportation meet quarterly with the Secretary and Deputy Secretary of 

Homeland Security to discuss cross-cutting and cross-Department issues and initiatives. PHMSA’s 

Administrator also meets regularly with the Assistant Secretary of Homeland Security – 

Transportation Security Administration. Assisting TSA achieve its goals has been and remains a 

matter of the highest agency priority. 

 

PHMSA representatives have met with TSA Pipeline Security Division staff at least quarterly to 

discuss accomplishments and milestones. In September, 2007, 9/11 Act items were placed on the 

Action Plan. At their meeting in December, 2007, both organizations identified primary points of 

contact to pass incident notification and follow-on with more detailed, operational information as 

events unfold. At a follow-up meeting in January 2008, changes to the Action Plan were made to 

reflect the agencies placing a priority on items in the 9/11 Commission Act. We plan routine 

coordination meetings between executives of each agency. 

PHMSA recently established the new position of Planning and Preparedness Manager in the Office of 

the Administrator, reporting directly to the Chief Safety Officer. The manager is responsible for all 

aspects of PHMSA’s emergency management and security policy activities and to provide liaison 

with other agencies, including TSA and stakeholders. Operationally, the manager is the designated 

Point of Contact for incident notification to TSA’s Pipeline Security Division’s Policy Director. 

In December, 2007, a senior PHMSA headquarters staff member accompanied TSA as it conducted a 

Corporate Security Review (CSR) of a pipeline operator that had experienced a leak of product 

caused by vandalism. The official also attended a meeting hosted by the Commander, United States 

Coast Guard (USCG), DHS, Sector St. Petersburg, of the Sector’s Maritime Security Council, 

concerning the vandalism event. 

Appendix. Agency Comments 
23

In another example, PHMSA worked with its TSA counterparts to address how the potentially 

sensitive information on PHMSA’s National Pipeline Mapping System (NPMS), originally 

withdrawn from the public website after the 9/11 attacks, could be made available as an information 

tool for the public and community planners. As a result of this cooperation, the NPMS Public Viewer 

was restored on the web in April, 2007. 

PHMSA participates in the DHS-sponsored Oil and Natural Gas, and Energy Government 

Coordinating Councils and associated Pipeline Sector Specific Council for coordination of a wide 

range of pipeline security issues with other Federal agency and private-sector officials. PHMSA 

participated in the February, 2008, DHS-sponsored Energy Critical Infrastructure Partnership 

Advisory Committee meeting. In December, 2007, TSA and DOT collaborated on a Transportation 

Security Information Sharing Plan that addresses several domains of security information, not 

otherwise addressed in the Annex. 

Since November, 2007, PHMSA, the Federal Energy Regulatory Commission (FERC), the 

Department of Energy (DOE), and the Protective Security Coordination Division of the Office of 

Infrastructure Protection, TSA, and USCG, of DHS, have been collaboratively developing procedures 

to perform Comprehensive Reviews (CRs) for security of Maritime Liquefied Natural Gas (LNG) 

Facilities. PHMSA has existing MOUs with FERC and USCG concerning security review 

responsibilities at Waterfront Import / Export LNG facilities. We have discussed plans to harmonize 

management of inspection for these facilities. We believe that CR practices developed by this 

workgroup may be applied by TSA in CRs for inland, Peak-Shaving LNG facilities. 

In total, PHMSA continues to communicate about pipeline incidents and facility safety information, 

coordinate pipeline security inspection activities, and work with TSA’s Pipeline Security Division to 

accomplish the activities listed in the Pipeline Security Action Plan. PHMSA will improve its 

documentation of plans, activities and milestones and initiate regular reporting on the Action Plan to 

PHMSA’s senior leadership. Additionally, PHMSA will continue to participate in several 

Government Coordinating Councils and Sector Coordinating Councils, hosted by the Department of 

Homeland Security’s National Protection and Programs Directorate to bring its experience in pipeline 

safety and security to the critical infrastructure context of those Councils. 

PHMSA’s RESPONSE TO RECOMMENDATIONS

Recommendation #1. Finalize the action plan for implementing the annex provisions and program 

elements and effectively execute the action plan. 

RESPONSE: Concur: As the action plan is a dynamic document, changes and adjustments to 

milestones are anticipated. PHMSA will particularly pursue issues where the interplay between 

safety and security may give PHMSA opportunities to share its safety knowledge, operational 

experience, and its extensive state partnerships in support of TSA’s security goals and 

implementation plans. 

PLANNED ACTION: PHMSA will continue to work with its TSA partners to regularly update and 

prioritize the items on the Action Plan, and then execute those items. The last update to the Action 

Plan is dated February, 2008. To improve accountability and management visibility, the pipeline 

security action plan will be updated monthly and forwarded to PHMSA’s Chief Safety Officer for 

review. 

Appendix. Agency Comments 
24

Recommendation #2. Amend the annex to delineate the roles and responsibilities of PHMSA and 

TSA in overseeing and enforcing security regulations for LNG operators. 

RESPONSE: Concur. PHMSA will work with TSA and the other agencies with which PHMSA has 

executed Memoranda of Understanding concerning LNG facilities1

 to determine if further 

clarification of roles and responsibilities in oversight and enforcement of security regulations for 

affected LNG operators is warranted. PHMSA will notify the OIG of this determination by June 30, 

2008. 

PLANNED ACTION: Regardless of the determination, PHMSA will propose to incorporate LNG 

facility inspections into the Action Plan at the next working group meeting. PHMSA will assist TSA 

in its communication and work with appropriate State pipeline agencies that have regulatory oversight 

of peak shaving LNG facilities, which make up the majority of LNG facilities in the Nation. PHMSA 

also will work with TSA to determine the extent to which the data PHMSA has collected, and its state 

partners’ field activities can inform TSA decisions on requirements of the 9/11 Commission Act and 

implement any resulting policy decisions. 

Recommendation #3. Maximize the strategy used to assess pipeline operators’ security plans and 

guidance to ensure effective and timely execution of congressional mandates in the 9/11 Commission 

Act. At a minimum, enhancements to the strategy need to include actively engaging PHMSA 

assistance in inspecting the 100 most critical pipeline operators’ pipeline security plans and critical 

facilities, and developing protocols and conducting vulnerability tests to effectively measure 

operators’ compliance with existing guidance or assess the adequacy of the guidance. 

RESPONSE: Concur. PHMSA will work closely with TSA to help execute the pipeline security 

mandates in the 9/11 Commission Act, as listed in the current Action Plan. When participating in a 

TSA CSR, PHMSA inspectors participate in an advisory role, based on their safety and regulatory 

focus, as TSA seeks voluntary operator cooperation on security issues. However, PHMSA inspectors 

would address a safety issue encountered during a CSR. 

PLANNED ACTION: While TSA generally advises PHMSA as they schedule CSR, PHMSA has 

not participated in the great majority of those reviews. PHMSA completed its FY08 pipeline safety 

inspection plan well before the OIG completed the investigation, and is into the second quarter of 

completing the scheduled inspections. PHMSA asked TSA how it intends to inspect the remainder of 

the top 100 operators’ critical facilities. TSA stated it plans to hire consultants to assist them perform 

inspections of the remaining critical facilities of the top 100 operators. As PHMSA’s pipeline 

inspection resources for FY08 are committed, it is unlikely that PHMSA would participate in these 

inspections. 

PHMSA recognizes that the separate issues of: (1) adequacy of existing standards and guidance, and 

(2) voluntary compliance with those standards, are both required for successful protection of the 

Nation’s pipeline infrastructure. As TSA and their consultants complete the inspections of the top 

100 operators’ critical facilities, PHMSA will work with TSA as it compiles and analyzes the results 

of the reviews to determine the extent to which operators have voluntarily complied with 2002 

security standards. 

 

1

 Currently, PHMSA has an MOU with the Federal Energy Regulatory Commission and the U.S. Coast Guard concerning 

regulatory purview of Waterfront LNG Import/Export facilities. 

Appendix. Agency Comments 
Appendix. Agency Comments 

25

PHMSA has little experience in covertly assessing the effectiveness of security plans that the OIG 

discusses in this report and must defer to TSA’s Pipeline Security Division, TSA’s Office of Security 

Assessments, and the Protective Security components in DHS for this expertise. Nonetheless, 

PHMSA also is very interested in working with TSA to review the macro definition used to define the 

top 100 operators, the variability in compliance among those operators, and the significance of any 

non-compliances found. PHMSA will continue to work with TSA as they determine if the 2002 

security standards and guidance are adequate to ensure the security of pipeline facilities. 

 

Based on the reviews of the Top 100 pipeline operators’ compliance with existing standards, and 

from the review of systematic (and perhaps covert) prospective assessments of vulnerability described 

by the OIG in the subject report, PHMSA looks forward to assisting TSA to determine if securityfocused regulations are needed to ensure the security of the Nation’s pipeline infrastructure. Whether 

regulations are determined to be required or not, PHMSA can assist TSA use program development 

practices similar to those applied to PHMSA’s Integrity Management Programs to help systematize 

our security support activities. This process is consistent with the actions detailed in the 9/11 

Commission Act and also detailed in the current Action Plan. 

 Sincerely, 

 Stacey L. Gerard 

 Assistant Administrator / Chief Safety Officer