Testimony 

Before the Subcommittee on National Security, 

Emerging Threats, and International Relations, 

Committee on Government Reform, House of 

Representatives 

United States General Accounting Office 

GAO

For Release on Delivery 

Expected at 9:30 a.m. EST 

Monday, February 23, 2004 HOMELAND SECURITY 

Federal Action Needed to 

Address Security 

Challenges at Chemical 

Facilities 

Statement of John B. Stephenson, Director 

Natural Resources and Environment 

GAO-04-482T 
Chemical facilities may be attractive targets for terrorists intent on causing 

economic harm and loss of life. Many facilities exist in populated areas 

where a chemical release could threaten thousands. The Environmental 

Protection Agency (EPA) reports that 123 chemical plants located 

throughout the nation could each potentially expose more than a million 

people if a chemical release occurred. To date, no one has comprehensively 

assessed the security of chemical facilities. 

No federal laws explicitly require that chemical facilities assess 

vulnerabilities or take security actions to safeguard their facilities from 

attack. However, a number of federal laws impose safety requirements on 

facilities that may help mitigate the effects of a terrorist-caused chemical 

release. Although EPA believes that the Clean Air Act could be interpreted to 

require security at certain chemical facilities, the agency has decided not to 

attempt to require these actions in light of the litigation risk and importance 

of an effective response to chemical security. Ultimately, no federal 

oversight or third-party verification ensures that voluntary industry 

assessments of vulnerability are adequate and that security vulnerabilities 

are addressed. 

Currently, the federal government has not comprehensively assessed the 

chemical industry’s vulnerabilities to terrorist attacks. EPA, the Department 

of Homeland Security (DHS), and the Department of Justice have taken 

preliminary steps to assist the industry in its preparedness efforts, but no 

agency monitors or documents the extent to which chemical facilities have 

implemented security measures. Consequently, federal, state, and local 

entities lack comprehensive information on the vulnerabilities facing the 

industry. 

To its credit, the chemical manufacturing industry, led by its industry 

associations, has undertaken a number of voluntary initiatives to address 

security at facilities. For example, the American Chemistry Council, whose 

members own or operate approximately 1,000, or 7 percent, of the facilities 

subject to Clean Air Act risk management plan provisions, requires its 

members to conduct vulnerability assessments and implement security 

improvements. The industry faces a number of challenges in preparing 

facilities against attacks, including ensuring that all chemical facilities 

address security concerns. Despite the industry’s voluntary efforts, the 

extent of security preparedness at U.S. chemical facilities is unknown. In 

October 2002 both the Secretary of Homeland Security and the 

Administrator of EPA stated that voluntary efforts alone are not sufficient to 

assure the public of the industry’s preparedness. Legislation is now pending 

that would mandate chemical facilities to take security steps to protect 

against the risk of a terrorist attack. 

HOMELAND SECURITY 

Federal Action Needed to Address 

Security Challenges at Chemical 

Facilities 

www.gao.gov/cgi-bin/getrpt?GAO-03-439.

To view the full report, including the scope 

and methodology, click on the link above. 

For more information, contact John B. 

Stephenson at (202) 512-3841 or 

stephensonj@gao.gov. 

Highlights of GAO-04-482T, a testimony 

before the Committee on Government 

Reform, Subcommittee on National 

Security, Emerging Threats, and 

International Relations, House of 

Representatives 

February 2004 

The events of September 11, 2001, 

triggered a national re-examination 

of the security of thousands of 

industrial facilities that use or store 

hazardous chemicals in quantities 

that could potentially put large 

numbers of Americans at risk of 

serious injury or death in the event 

of a terrorist-caused chemical 

release. GAO was asked to 

examine (1) available information 

on the threats and risks from 

terrorism faced by U.S. chemical 

facilities; (2) federal requirements 

for security preparedness and 

safety at facilities; (3) actions taken 

by federal agencies to assess the 

vulnerability of the industry; and 

(4) voluntary actions the chemical 

industry has taken to address 

security preparedness, and the 

challenges it faces in protecting its 

assets and operations. GAO issued 

a report on this work in March 2003 

(GAO-03-439). 

GAO’s March 2003 report 

recommended that the Secretary of 

Homeland Security and the 

Administrator of EPA jointly 

develop a comprehensive national 

chemical security strategy that is 

both practical and cost effective, 

which includes assessing 

vulnerabilities to terrorist attacks 

and enhancing security 

preparedness. 

Legislation is now before Congress 

that, if enacted, would direct DHS, 

or DHS and EPA, to adopt most of 

GAO’s March 2003 

recommendations. 
Page 1 GAO-04-482T Chemical Security 

Mr. Chairman and Members of the Subcommittee: 

Thank you for the opportunity to discuss our work on the security of the 

nation’s chemical facilities and the recommendations that we made to 

address this issue in our March 2003 report.1

 

As the events of September 11, 2001, showed, terrorists can cause 

enormous damage to our country by attacking infrastructure essential to 

our economy and jeopardizing public health and safety. Following these 

events, the President, in the National Strategy for Homeland Security, 

identified the chemical industry as one of 13 sectors critical to the nation’s 

infrastructure. Across the nation, thousands of industrial facilities 

manufacture, use, or store hazardous chemicals in quantities that could 

potentially put large numbers of Americans at risk of injury or death in the 

event of a chemical release. 

Even before September 11, 2001, protecting chemical facilities was the 

shared responsibility of federal, state, and local governments in 

partnership with the private sector. However, attention was focused 

largely on the risks of accidental, rather than intentional, chemical 

releases. Under the Clean Air Act, the Environmental Protection Agency 

(EPA) identified 140 toxic and flammable chemicals that pose the greatest 

risk to human health and the environment when present in certain 

quantities above threshold levels. According to EPA, approximately 15,000 

facilities in a variety of industries produce, use, or store one or more of 

these chemicals beyond threshold amounts. Under the act, these facilities 

must take steps to prevent and prepare for an accidental chemical release, 

including developing risk management plans (RMP). These facilities are 

referred to as RMP facilities. The events of September 11, 2001, brought 

heightened attention to security at chemical facilities and the possibility of 

a chemical release caused by a terrorist attack. 

The federal government’s role in protecting chemical facilities from 

terrorist attacks has been much debated since September 11, 2001. 

Initially, EPA had the lead responsibility for chemical security; currently 

the Department of Homeland Security (DHS) is the lead federal agency. 

For both agencies, public debate has centered on whether the federal 

 1

U.S. General Accounting Office, Homeland Security: Voluntary Initiatives Are Under 

Way at Chemical Facilities, but the Extent of Security Preparedness Is Unknown, 

GAO-03-439 (Washington, D.C.: Mar. 14, 2003). 
Page 2 GAO-04-482T Chemical Security 

government should impose security requirements on chemical facilities or 

whether voluntary industry actions are sufficient. Several legislative 

proposals have been introduced that address security measures at 

chemical facilities, including provisions giving DHS, or EPA and DHS, 

authority to mandate security measures at chemical facilities. 

My remarks today will focus on security preparedness at the nation’s 

chemical facilities. In particular I will (1) summarize available information 

on the threats and risks from terrorism that U.S. chemical facilities face; 

(2) describe federal requirements for security preparedness and the safe 

management of chemicals at these facilities; (3) describe actions federal 

agencies have taken to assess the vulnerability of the chemical industry or 

to address security preparedness; and (4) describe voluntary actions the 

chemical industry has taken to address security preparedness, and the 

challenges it faces in protecting its assets and operations. Our 2003 report 

was based on our review of available reports, statutes and regulations, and 

industry association documents; interviews with officials from the 

Department of Defense, the Department of Justice, EPA, industry 

associations including the American Chemistry Council (ACC) and the 

Synthetic Organic Chemical Manufacturers Association (SOCMA), and 

other chemical industry officials; and selected chemical facility site visits. 

We limited our review to stationary chemical facilities and did not address 

security concerns surrounding transportation of hazardous chemicals.2

Appendix I provides additional information on the processes covered 

under the Clean Air Act’s for RMP facilities, by industry sector, and the 

residential population surrounding RMP facilities that could be 

threatended by a “worst-case” accidental chemical release. 

In summary, experts agree that the nation’s chemical facilities may be 

attractive targets for terrorists intent on causing massive damage, but the 

extent of security preparedness since the events of September 11, 2001, is 

unknown. The risk of an attack varies among facilities depending upon 

several factors, including their location and the types of chemicals they 

use, store, or manufacture. No specific data exist on the actual effects of 

successful terrorist attacks on chemical facilities. However, according to 

 2

For information on the transportation of hazardous material, see U.S. General Accounting 

Office, Rail Safety and Security: Some Actions Already Taken to Enhance Rail Security, 

but Risk-based Plan Needed, GAO-03-435 (Washington, D.C.: April 2003) and U.S. General 

Accounting Office, Transportation Security: Federal Action Needed to Help Address 

Security Challenges, GAO-03-843 (Washington, D.C.: June 2003). 

Summary 
Page 3 GAO-04-482T Chemical Security 

EPA data on accidental toxic release “worst-case” scenarios, 123 chemical 

facilities located throughout the nation could each potentially expose 

more than one million people in the surrounding area if a toxic release 

occurred. Approximately 700 facilities could each potentially threaten at 

least 100,000 people in the surrounding area, and about 3,000 facilities 

could each potentially threaten at least 10,000 people. To date, no one has 

comprehensively assessed the security of chemical facilities; however, 

numerous studies and media accounts of reporters and environmental 

activists gaining access to facilities indicate that vulnerabilities exist. 

Unlike water treatment facilities and nuclear power facilities, chemical 

facilities are not subject to any federal requirements to assess and address 

security vulnerabilities against terrorist attacks. However, a number of 

federal laws impose safety requirements that may help mitigate the effects 

of a chemical release resulting from a terrorist attack. A case in point is 

the Clean Air Act’s requirements that RMP facilities take safety 

precautions to detect and minimize the effects of accidental releases, as 

well as provide prompt emergency response to a release. Although EPA 

believes the Clean Air Act could be interpreted to require security actions 

at RMP facilities, the agency has decided not to attempt to require these 

actions in light of the litigation risk and importance of an effective 

response to chemical security. In addition, under the regulations for the 

Maritime Transportation Security Act of 2002, vessels and port facilities—

some of which are chemical facilities—must develop security plans. 

However, no federal oversight or third-party verification ensures that 

voluntary industry assessments of vulnerability are adequate and that 

security vulnerabilities are addressed. 

Currently, the federal government has not comprehensively assessed the 

chemical industry’s vulnerability to terrorist attacks. As a result, federal, 

state, and local entities lack comprehensive information on the 

vulnerabilities the industry faces. However, federal agencies have taken 

some preliminary steps to assist the industry in its preparedness efforts. 

For example, EPA has issued warning alerts to the industry and informally 

visited about 30 high-risk facilities to learn about and encourage security 

efforts. According to EPA officials, EPA has provided information to DHS 

about the 15,000 facilities and DHS is currently identifying high-risk 

facilities and conducting site visits. In May 2002, Justice submitted an 

interim report to Congress that described observations on security at 11 

chemical manufacturing facilities. As we reported in October 2002, 

however, Justice has not prepared a more comprehensive final report to 

Congress on the industry’s vulnerabilities, which it was required by law to 

deliver in August 2002. In a February 2003 conference report on Justice’s 
Page 4 GAO-04-482T Chemical Security 

appropriations, Congress directed that funding be transferred to DHS for 

completing vulnerability assessments at chemical facilities. 

Finally, although the chemical industry has undertaken a number of 

initiatives to address security concerns, the extent of security 

preparedness across the chemical industry is unknown. The American 

Chemistry Council—whose 145 member companies own or operate 

approximately 1,000 (7 percent) of the 15,000 RMP facilities—now 

requires, as a condition of membership, that facilities conduct security 

vulnerability assessments and implement security improvements. EPA 

officials estimate that voluntary initiatives led by industry associations 

only reach a portion of the 15,000 RMP facilities. Moreover, the industry 

faces a number of challenges in preparing facilities against terrorist 

attacks, including ensuring that facilities obtain adequate information on 

threats and determining the appropriate security measures given the level 

of risk. In October 2002, both the Secretary of Homeland Security and the 

then-Administrator of EPA stated that voluntary efforts alone are not 

sufficient to assure the public of the industry’s preparedness. They also 

stated that they would support bipartisan legislation to require the 15,000 

chemical facilities nationwide that contain large quantities of hazardous 

chemicals to comprehensively assess their vulnerabilities and then act to 

reduce them. 

In light of the challenges facing the industry and the gravity of the 

potential threat, we recommended in March 2003 that the Secretary of 

Homeland Security and the Administrator of EPA jointly develop a 

comprehensive national strategy for chemical security that is both 

practical and cost effective. This national strategy should 

• identify high-risk facilities based on several factors, including the level of 

threat, and collect information on industry security preparedness; 

• specify the roles and responsibilities of each federal agency partnering 

with the chemical industry; 

• develop appropriate information-sharing mechanisms; and 

• develop a legislative proposal, in consultation with industry and other 

appropriate groups, to require these chemical facilities to expeditiously 

assess their vulnerability to terrorist attacks and, where necessary, require 

these facilities to take corrective action. 

Legislation is now before Congress that, if enacted, would direct DHS, or 

DHS and EPA, to adopt most of these recommendations. 
Page 5 GAO-04-482T Chemical Security 

Chemical facilities manufacture a host of products—including basic 

organic chemicals, plastic materials and resins, petrochemicals, and 

industrial gases, to name a few. Other facilities, such as fertilizer and 

pesticide facilities, pulp and paper manufacturers, water facilities, and 

refineries, also house large quantities of chemicals. EPA has a role in 

preventing and mitigating accidental releases at chemical facilities 

through, among other things, the RMP provisions of the Clear Air Act. 

Under these provisions, EPA identified 140 toxic and flammable chemicals 

that, when present above certain threshold amounts, would pose the 

greatest risk to human health and the environment if released. According 

to EPA, approximately 15,000 facilities in a variety of industries produce, 

use, or store one or more of these chemicals beyond threshold amounts. 

The 2003 President’s National Strategy for the Physical Protection of 

Critical Infrastructures and Key Assets sets forth actions that EPA and 

DHS will take to secure the chemical infrastructure. The strategy directs 

EPA and DHS to promote enhanced site security at chemical facilities and 

review current practices and statutory requirements on the distribution 

and sale of certain pesticides and industrial chemicals to help identify 

whether additional measures are necessary. DHS is also charged with 

continuing to develop the Chemical Sector Information Sharing and 

Analysis Center, a partnership with industry to facilitate the collection and 

sharing of threat information, by promoting the Center and recruiting 

chemical industry constituents to participate. A presidential directive 

issued in December 2003 designates DHS as the lead federal agency for 

chemical security, a change from national strategies issued in July 2002 

and February 2003, which named EPA as the lead. 

A number of other critical infrastructures have federal security 

requirements. All commercial nuclear power facilities licensed by the 

Nuclear Regulatory Commission are subject to a number of security 

requirements. The Aviation and Transportation Security Act of 2001 

directed the Transportation Security Administration to take over 

responsibility for airport screening. The Public Health Security and 

Bioterrorism Preparedness and Response Act of 2002 requires community 

water systems serving more than 3,300 people to conduct a vulnerability 

assessment, prepare an emergency response plan, certify to EPA that the 

vulnerability assessment and emergency response plan have been 

completed, and provide a copy of the assessment to EPA. To improve 

security in our nation’s ports, the regulations implementing the Maritime 

Background 
Page 6 GAO-04-482T Chemical Security 

Transportation Security Act of 2002 direct vessels and facilities—some of 

which are chemical facilities—to develop security plans.3

Congress is considering several legislative proposals that would grant 

DHS, or DHS and EPA, the authority to require chemical facilities to take 

security steps. S. 994 requires the Secretary of Homeland Security to 

promulgate regulations specifying which facilities should be required to 

conduct vulnerability assessments and to prepare and implement site 

security plans, a timetable for completing the vulnerability assessments 

and security plans, the contents of plans, and limits on the disclosure of 

sensitive information. S. 157 would direct EPA to designate high-priority 

chemical facilities based on the threat posed by an unauthorized release 

and require these facilities to conduct vulnerability assessments, identify 

hazards that would result from a release, and prepare a prevention, 

preparedness, and response plan. S. 157 would also require facilities to 

send these assessments and plans to EPA. EPA and DHS would jointly 

review the assessments and plans to determine compliance. S. 157 would 

also require that facilities consider inherently safer practices (referred to 

as inherently safer technologies), such as substituting less toxic chemicals. 

Experts agree that chemical facilities present an attractive target for 

terrorists intent on causing massive damage because many facilities house 

toxic chemicals that could become airborne and drift to surrounding areas 

if released. Chemical facilities could also be attractive targets for the theft 

of chemicals that could be used to create a weapon capable of causing 

harm. Justice has concluded that the risk of an attempt in the foreseeable 

future to cause an industrial chemical release is both real and credible. In 

fact, according to Justice, domestic terrorists plotted to use a destructive 

device against a U.S. facility that housed millions of gallons of propane in 

the late 1990s. In testimony on February 6, 2002, the Director of the 

Central Intelligence Agency warned of the potential for an attack by al 

Qaeda on chemical facilities. 

Some chemical facilities may be at higher risk of a terrorist attack than 

others because they contain large amounts of toxic chemicals and are 

located near population centers. Attacks on such facilities could harm a 

 3

In responding to our draft, EPA noted that approximately 2,000 RMP facilities may be 

covered under the Public Health Security and Bioterrorism Preparedness and Response Act 

of 2002. 

An Attack Against 

Chemical Facilities 

Could Cause 

Economic Harm and 

Loss of Life 
Page 7 GAO-04-482T Chemical Security 

large number of people, with health effects ranging from mild irritation to 

death, cause large-scale evacuations, and disrupt the local or regional 

economy. No specific data are available on what the actual effects of 

successful terrorist attacks on chemical facilities would be. However, RMP 

facilities must submit to EPA estimates, including the residential 

population located within the range of a toxic gas cloud produced by a 

“worst-case” chemical release, called the “vulnerable zone.” According to 

EPA, 123 chemical facilities located throughout the nation have toxic 

“worst-case” scenarios where more than one million people could be at 

risk of exposure to a cloud of toxic gas.4

 About 600 facilities could each 

potentially threaten between 100,000 and a million people, and about 2,300 

facilities could each potentially threaten between 10,000 and 100,000 

people within these facilities’ “vulnerable zones.” 

According to EPA, “worst-case” scenarios do not consider the potential 

causes of a release or how different causes or other circumstances, such 

as safety features, could lessen the consequences of a release. Hence, the 

“worst-case” scenario calculations would likely be overstating the 

potential consequences. However, under the Clean Air Act, RMP facilities 

must estimate the effects of a toxic chemical release involving the greatest 

amount of the toxic chemical held in a single vessel or pipe—not the entire 

quantity on site. Therefore, for some facilities it is conceivable that an 

attack where multiple chemical vessels were breached simultaneously 

could result in an even larger release, potentially affecting a larger 

population than estimated in the RMP “worst-case” scenarios. Other 

factors besides location and the quantity of chemicals onsite could also 

make a facility a more attractive target. For example, a facility that is 

widely recognizable, located near a historic or iconic symbol, or critical to 

supporting other infrastructures could be at higher risk. A 2002 Brookings 

 4

“Vulnerable zones” are determined by drawing a circle around a facility with the radius of 

the circle equal to the distance a toxic gas cloud would travel before dissipating to 

relatively harmless levels. Because, in an actual event, the toxic cloud would only cover a 

fraction of that circle, it is unlikely that the event would actually result in exposure of the 

entire population estimated in the “worst-case” scenario, according to EPA. The number of 

persons within a “vulnerable zone” is larger than the number of persons that would be 

affected by a “worst-case” scenario. In addition, EPA’s requirements for “worst-case” 

release analysis tend to result in consequence estimates that are significantly higher than 

what is likely to actually occur. For example, “worst-case” release analysis does not take 

into account active mitigation measures facilities often employ to reduce the consequences 

of releases. 
Page 8 GAO-04-482T Chemical Security 

Institution report ranks an attack on toxic chemical facilities behind only 

biological and atomic attacks in terms of possible fatalities.5

Currently, no one has comprehensively assessed security across the nation 

at facilities that house chemicals. According to a 1999 study by the 

Department of Health and Human Services’ Agency for Toxic Substances 

and Disease Registry (ATSDR), security at chemical facilities in two 

communities was fair to very poor. ATSDR observed security 

vulnerabilities such as freely accessible chemical barge terminals and 

chemical rail cars parked near residential areas in communities where 

facilities are located. Following visits to 11 chemical facilities, Justice 

concluded that some facilities may need to implement more effective 

security systems and develop alternative means to reduce the potential 

consequences of a successful attack. The ease with which reporters and 

environmental activists gained access to chemical tanks and computer 

centers that control manufacturing processes at chemical facilities in 

recent years also raises doubts about security effectiveness at some 

facilities. 

No federal laws explicitly require all chemical facilities to take security 

actions to safeguard their facilities against a terrorist attack. Although the 

federal government requires certain chemical facilities to take security 

precautions directed to prevent trespassing or theft, these requirements do 

not cover a wide range of chemical facilities and may do little to actually 

prevent a terrorist attack. For example, under EPA’s regulations 

implementing the Resource Conservation and Recovery Act of 1976, 

facilities that house hazardous waste generally must take certain security 

actions, such as posting warning signs and using a 24-hour surveillance 

system or surrounding the active portion of the facility with a barrier and 

controlled entry gates.6

 However, according to EPA, these requirements 

would be applicable to only approximately 21 percent of the 15,000 RMP 

facilities. Regulations implementing the Maritime Transportation Security 

Act of 2002 also require vessels and port facilities—some of which are 

chemical facilities—to develop security plans. 

 5

The Brookings Institution, Protecting the American Homeland: A Preliminary Analysis, 

(Washington, D.C.: 2002). 

6

40 C.F.R. § 264.14. 

No Federal 

Requirements 

Specifically Require 

Chemical Facilities to 

Address the Threat of 

Terrorism 
Page 9 GAO-04-482T Chemical Security 

A number of federal laws also impose safety requirements on chemical 

facilities, but these requirements do not specifically and directly address 

security preparedness against terrorism. Several statutes, including the 

Occupational Safety and Health Act, the Clean Air Act, and the Emergency 

Planning and Community Right-to-Know Act, impose safety and 

emergency response requirements on chemical facilities that may 

incidentally reduce the likelihood and mitigate the consequences of 

terrorist attacks.7

 All of these requirements could potentially mitigate a 

terrorist attack in a number of ways. First, because some of these 

requirements only apply to facilities with more than threshold quantities of 

certain chemicals, facility owners have an incentive to reduce or eliminate 

these chemicals, which may make the facility a less attractive target or 

minimize the impact of an attack. Second, both the Clean Air Act risk 

management plan provisions and the hazard analyses under the 

Occupational Safety and Health Act require facility operators to identify 

the areas of their facilities that are vulnerable to a chemical release. When 

facilities implement measures to improve the safety of these areas, such as 

installing sensors and sprinklers, the impact of a terrorist-caused release 

may be lessened. Third, the emergency response plans increase 

preparedness for a chemical release—whether intentional or 

unintentional. While these safety requirements could mitigate the effects 

of a terrorist attack, they do not impose any security requirements, such as 

conducting vulnerability assessments and addressing identified problems. 

While no law explicitly requires facilities to address the threat of 

terrorism, EPA believes that the Clean Air Act could be interpreted to 

provide it with authority to address site security from terrorist attacks at 

chemical facilities. Section 112(r) of the Clean Air Act—added by the 

Clean Air Act Amendments of 1990—imposes certain requirements on 

chemical facilities with regard to “accidental releases.” The act defines an 

accidental release as an unanticipated emission of a regulated substance 

or other extremely hazardous substance into the air. Arguably, any 

chemical release caused by a terrorist attack would be unanticipated and 

thus could be covered under the Clean Air Act. An interpretation of an 

unanticipated emission as including an emission due to a terrorist attack 

would provide EPA with authority to require security measures or 

vulnerability assessments with regard to terrorism. However, EPA has not 

 7

We focus our discussion in this testimony on those requirements dealing with assessments 

of hazards and emergency response. However, the Toxic Substances Control Act also may 

mitigate the consequences of a terrorist attack by limiting or eliminating certain toxic 

chemicals that a facility manufactures or uses. 
Page 10 GAO-04-482T Chemical Security 

attempted to use these Clean Air Act provisions. EPA is concerned that 

such an interpretation would pose significant litigation risk. As we 

reported in March 2003, there are a number of practical and legal 

arguments against this interpretation. We find that EPA could reasonably 

interpret its Clean Air Act authority to cover chemical security, but also 

agree with the agency that this interpretation could be open to challenges. 

At the time of our 2003 review, EPA supported passage of legislation to 

specifically address chemical security. 

Despite a congressional mandate to do so, the federal government has not 

conducted the assessments necessary to develop comprehensive 

information on the chemical industry’s vulnerabilities to terrorist attacks.8

The Chemical Safety Information, Site Security and Fuels Regulatory 

Relief Act of 1999 required Justice to review and report on the 

vulnerability of chemical facilities to terrorist or criminal attack. In May 

2002, nearly 2 years after it was due, Justice prepared and submitted an 

interim report to Congress that described observations on security at 11 

chemical manufacturing facilities Justice visited to develop a methodology 

for assessing vulnerability, but its observations cannot be generalized to 

the industry as a whole. In its fiscal year 2003 budget, Justice asked for $3 

million to conduct chemical plant vulnerability assessments. In the 

February 2003 conference report on Justice’s appropriation act for fiscal 

year 2003,9

 Congress directed that $3 million of the funding being 

transferred to DHS to be used for the chemical plant vulnerability 

assessments. Justice believes that chemical plant vulnerability 

assessments are now part of DHS’ mission. 

Federal agencies have taken preliminary steps to assist the industry in its 

preparedness efforts. While Justice has not assessed the vulnerability of 

the chemical industry, it has provided the industry with a tool for 

individual facilities to use in assessing their vulnerabilities. Justice, 

together with the Department of Energy’s Sandia National Laboratories, 

developed a vulnerability assessment methodology for evaluating the 

vulnerability to terrorist attack of facilities handling chemicals. The 

 8

For a discussion on Justice’s actions to assess the chemical industry’s vulnerability to 

terrorist attack, see U.S. General Accounting Office, Homeland Security: Department of 

Justice’s Response to Its Congressional Mandate to Assess and Report on Chemical 

Industry Vulnerabilities, GAO-03-24R (Washington, D.C.: Oct. 10, 2002).

9

H.R. Conf. Rept. No. 108-10, at 600 (2003). 

Federal Agencies 

Have Not 

Comprehensively 

Assessed the 

Vulnerability of the 

Chemical Industry to 

Terrorism, but Have 

Taken Some 

Preliminary Steps 
Page 11 GAO-04-482T Chemical Security 

methodology helps facilities identify and assess threats, risks, and 

vulnerabilities and develop recommendations to reduce risk, where 

appropriate. As the lead federal agency for the operational response to 

terrorism, Justice’s FBI is responsible for weapons of mass destruction 

threat assessment and communicating warnings. Finally, agents in the 

FBI’s local field offices provide information and technical assistance to 

state and local jurisdictions and to some chemical facilities to bolster their 

preparedness to respond to terrorist incidents. 

EPA has also taken some actions. Officials have analyzed the agency’s 

database of RMP facilities to identify high-risk sites for DHS and Justice’s 

Federal Bureau of Investigation (FBI). But these facilities are only a 

portion of the universe of all industrial facilities that house toxic or 

hazardous chemicals. At the time of our review, EPA had not analyzed 

non-RMP facilities to determine whether any of those facilities should be 

considered at high risk for a terrorist attack. EPA has also issued warning 

alerts to the industry, hosted training classes on vulnerability assessment 

methodologies, and informally visited about 30 high-risk facilities to learn 

about and encourage security efforts. Finally, DHS’ Information Analysis 

and Infrastructure Protection directorate collects information from the 

U.S. intelligence community, other federal agencies, and the private sector. 

Working with ACC, an industry association representing chemical 

manufacturers, DHS also supports the Chemical Sector Information 

Sharing and Analysis Center to collect and share threat information for the 

chemical industry. In addition, according to EPA officials, DHS has begun 

identifying high-risk facilities and conducting site visits at facilities. 

However, neither EPA nor DHS is currently monitoring the extent to 

which the industry has implemented security measures. 

The chemical manufacturing industry has undertaken a number of 

voluntary initiatives to address security concerns at chemical facilities, 

including developing security guidelines and tools to assess vulnerabilities, 

but major challenges remain. All of the industry groups with whom we met 

have taken actions such as forming security task forces, holding meetings 

and conferences to share security information with members, and 

participating in security briefings with federal agencies. In response to the 

terrorist attacks on September 11, 2001, ACC—whose members own or 

operate approximately 1,000 RMP facilities —-now requires its members, 

as a condition of membership, to rank facilities using a screening tool to 

evaluate its facilities’ risk level. It also requires facilities to identify, assess, 

and address vulnerabilities at facilities using one of several available 

Chemical Industry 

Has Taken Voluntary 

Actions to Address 

Security Concerns but 

Faces Significant 

Challenges in 

Preparing Against 

Terrorist Attacks 
Page 12 GAO-04-482T Chemical Security 

vulnerability assessment methodologies. In doing so, ACC member 

facilities generally follow a multistep process that includes 

• evaluating on-site chemical hazards, existing safety and security features, 

and the attractiveness of the facility as a terrorist target; 

• using hypothetical threat scenarios to identify how a facility is vulnerable 

to attack; and 

• identifying security measures that create layers of protection around a 

facility’s most vulnerable areas to detect, delay, or mitigate the 

consequences of an attack. 

ACC established time frames for completing the vulnerability assessment 

and implementing security measures, based on the facility’s risk ranking. 

ACC reports that the 120 facilities ranked as the highest risk and 372 

facilities ranked as the next highest have completed vulnerability 

assessments. Most of ACC’s lower-risk facilities are progressing on 

schedule. ACC generally requires third-party verification that the facility 

has made the improvements identified in its vulnerability assessment.10

While these are commendable actions, they do not provide a high level of 

assurance that chemical facilities have better protected their facilities 

from terrorist attack. First, ACC does not require third parties to verify 

that the facility has conducted the vulnerability assessment appropriately 

or that its actions adequately address security risks. Even though 

compliance with ACC’s safety and security requirements is a condition of 

membership, we do not believe that its requirements for facilities to 

periodically report on compliance with these requirements is an effective 

enforcement measurement because ACC does not verify implementation 

or evaluate the adequacy of facility measures. Second, its member 

facilities comprise only 7 percent of the facilities required to submit risk 

management plans to EPA, leaving about 14,000 other RMP facilities that 

may not participate in voluntary security efforts. These facilities include 

agricultural suppliers, such as fertilizer facilities; petroleum and natural 

gas facilities; food storage facilities; water treatment facilities; and 

wastewater treatment facilities, among others. Third, other facilities house 

 10The lowest-risk facilities may use a less rigorous methodology to identify and make 

security enhancements and are not required to obtain third-party verification that 

improvements have been made. In addition, by December 2005, member companies will 

have to had their compliance with safety and security requirements certified by 

independent third-party auditors. 
Page 13 GAO-04-482T Chemical Security 

chemicals that EPA has identified as hazardous, but in quantities that are 

below the threshold level required to be categorized as RMP facilities. 

Other industry groups are also developing security initiatives, but the 

extent of these efforts varies from issuing security guidance to requiring 

vulnerability assessments. For example, the American Petroleum Institute, 

which represents petroleum and natural gas facilities, published security 

guidelines developed in collaboration with the Department of Energy that 

are tailored to the differing security needs of industry sectors. Despite 

industry associations’ efforts to encourage security actions at facilities, the 

extent of participation in voluntary initiatives is unclear. EPA officials 

estimate that voluntary initiatives led by industry associations only reach a 

portion of the 15,000 RMP facilities. Furthermore, EPA officials stated that 

these voluntary initiatives raise an issue of accountability, since the extent 

to which industry group members are implementing voluntary initiatives is 

unknown. 

The chemical industry faces a number of challenges in preparing facilities 

against terrorist attacks, including ensuring that facilities obtain adequate 

information on threats and determining the appropriate security measures 

given the level of risk. Trade association and industry officials identified a 

number of concerns about preparing against terrorist attacks. First, 

industry officials noted that they need better threat information from law 

enforcement agencies, as well as better coordination among agencies 

providing threat information. Second, industry officials report that 

chemical companies face a challenge in achieving cost-effective security 

solutions, noting that companies must weigh the cost of implementing 

countermeasures against the perceived reduction in risk. Industry groups 

with whom we spoke indicated that their member companies face the 

challenge of effectively allocating limited security resources. Third, 

facilities face pressure from public interest groups to implement 

inherently safer practices (referred to in the industry as inherently safer 

technologies), such as lowering toxic chemical inventories and 

redesigning sites to reduce risks. Justice has also recognized that reducing 

the quantity of hazardous material may make facilities less attractive to 

terrorist attack and reduce the severity of an attack. While industry 

recognizes the contribution that inherently safer technologies can make to 

reducing the risk of a terrorist attack, industry officials noted that 

decisions about inherently safer technologies require thorough analysis 

and may shift, rather than reduce, risks. Finally, industry officials stated 

that the industry faces a challenge in engaging all chemical facilities in 

voluntary security efforts. ACC has made efforts to enlist facilities beyond 

its membership in voluntary security initiatives. The Synthetic Organic 
Page 14 GAO-04-482T Chemical Security 

Chemical Manufacturers’ Association (SOCMA) adopted ACC’s security 

code for its member facilities as a condition of membership. However, the 

extent to which all partnering companies and associations implement the 

requirements is unclear. 

Mr. Chairman, this concludes my prepared statement. I would be happy to 

respond to any questions that you or Members of the Subcommittee may 

have. 

For further information about this testimony, please contact me at (202) 

512-3841. Joanna Owusu, Vince Price, Carol Herrnstadt Shulman, and Amy 

Webbink made key contributions to this statement. 

Contacts and 

Acknowledgements 
Page 15 GAO-04-482T Chemical Security 

This appendix presents information on the processes covered under the 

Clean Air Act’s requirements for risk management plan (RMP) facilities by 

industry sector and the residential population surrounding RMP facilities 

that could be threatened by a “worst-case” accidental chemical release. 

Table 1: Number and Percent of RMP-Covered Processes by Industry Sector 

Industry sector 

Number of 

processes 

Percent of 

processes 

Agriculture & farming, farm supply, fertilizer 

production, pesticides 

6,317 31 

Water supply and wastewater treatment 3,753 18 

Chemical manufacturing 3,803 18 

Energy production, transmission, transport, and sale 3,038 15 

Food and beverage manufacturing & storage 

(including refrigerated warehousing) 

2,366 11 

Chemical warehousing (not including refrigerated 

warehousing) 

318 2 

Othera 1,075 5 

Totalb 20,670 100 

Source: EPA. 

a

Other represents a large variety of industry sectors including pulp mills, iron and steel mills, cement 

manufacturing, and computer manufacturing. 

b

The total number of covered processes is not equal to the 15,000 RMP facilities because some RMP 

facilities have more than one covered process (i.e., a process containing more than a threshold 

amount of a covered hazardous chemical). 

Appendix I: RMP-Covered Industrial 

Processes and Off-Site Consequences of 

Worst-Case Chemical Releases 
Page 16 GAO-04-482T Chemical Security 

Figure 1: Number of Facilities with Worst-Case Accidental Release Scenarios by 

Residential Population Potentially Threatened 

Notes: EPA, Chemical Accident Risks in U.S. Industry – A Preliminary Analysis of Accident Risk Data 

from U.S. Hazardous Chemical Facilities, Washington, D.C.: September 25, 2000. 

This figure includes only those facilities with toxic chemicals that could lead to a “worst-case” 

scenario. Facilities that only have flammable chemical “worst-case” scenarios are not included. 

Flammable chemicals affect fewer people because the distance the flammable substance travels 

tends to be significantly shorter. 

(360442) 
This is a work of the U.S. government and is not subject to copyright protection in the 

United States. It may be reproduced and distributed in its entirety without further 

permission from GAO. However, because this work may contain copyrighted images or 

other material, permission from the copyright holder may be necessary if you wish to 

reproduce this material separately. 
The General Accounting Office, the audit, evaluation and investigative arm of 

Congress, exists to support Congress in meeting its constitutional responsibilities 

and to help improve the performance and accountability of the federal 

government for the American people. GAO examines the use of public funds; 

evaluates federal programs and policies; and provides analyses, 

recommendations, and other assistance to help Congress make informed 

oversight, policy, and funding decisions. GAO’s commitment to good government 

is reflected in its core values of accountability, integrity, and reliability. 

The fastest and easiest way to obtain copies of GAO documents at no cost is 

through the Internet. GAO’s Web site (www.gao.gov) contains abstracts and fulltext files of current reports and testimony and an expanding archive of older 

products. The Web site features a search engine to help you locate documents 

using key words and phrases. You can print these documents in their entirety, 

including charts and other graphics. 

Each day, GAO issues a list of newly released reports, testimony, and 

correspondence. GAO posts this list, known as “Today’s Reports,” on its Web site 

daily. The list contains links to the full-text document files. To have GAO e-mail 

this list to you every afternoon, go to www.gao.gov and select “Subscribe to e-mail 

alerts” under the “Order GAO Products” heading. 

The first copy of each printed report is free. Additional copies are $2 each. A 

check or money order should be made out to the Superintendent of Documents. 

GAO also accepts VISA and Mastercard. Orders for 100 or more copies mailed to a 

single address are discounted 25 percent. Orders should be sent to: 

U.S. General Accounting Office 

441 G Street NW, Room LM 

Washington, D.C. 20548 

To order by Phone: Voice: (202) 512-6000 

TDD: (202) 512-2537 

Fax: (202) 512-6061 

Contact: 

Web site: www.gao.gov/fraudnet/fraudnet.htm 

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470 

Jeff Nelligan, Managing Director, NelliganJ@gao.gov (202) 512-4800 

U.S. General Accounting Office, 441 G Street NW, Room 7149 

Washington, D.C. 20548 

GAO’s Mission 

Obtaining Copies of 

GAO Reports and 

Testimony 

Order by Mail or Phone 

To Report Fraud, 

Waste, and Abuse in 

Federal Programs 

Public Affairs