GAO-03-24R Security of Chemical Facilities

United States General Accounting Office

Washington, DC 20548

October 10, 2002

The Honorable John D. Dingell

Ranking Minority Member

Committee on Energy and Commerce

House of Representatives

The Honorable Frank Pallone, Jr.

Ranking Minority Member

Subcommittee on Environment and Hazardous Materials

Committee on Energy and Commerce

House of Representatives

Subject: Homeland Security: Department of Justice’s Response to Its

Congressional Mandate to Assess and Report on Chemical Industry

Vulnerabilities

On August 5, 1999, after a number of testimonies expressing concerns about the

vulnerability of chemical facilities1

 to criminal and terrorist attacks, Congress passed

the Chemical Safety Information, Site Security and Fuels Regulatory Relief Act

(CSISSFRRA),2 which, among other things, required the Department of Justice to

review the vulnerability of these facilities. The act also required the Attorney General

to prepare two reports—an interim report containing preliminary findings by

August 5, 2000, and a final report by August 5, 2002.

Specifically, Justice was to address the extent to which Clean Air Act regulations

regarding the prevention of accidental releases have resulted in actions, including the

design and maintenance of safe chemical facilities, that are effective in detecting,

preventing, and minimizing the consequences of regulated substances that may be

released as a result of criminal activity. Furthermore, using available data to the

extent possible and a sample of facilities, and consulting with appropriate state, local,

and federal government agencies, affected industry, and the public, Justice was to

 1

We use the term “chemical facilities” in this report to mean those stationary sources covered under

section 112(r) of the Clean Air Act.

2

Pub. L. No. 106-40, 113 Stat. 207 (1999).
2 GAO-03-24R Security of Chemical Facilities

review the vulnerability of chemical facilities to criminal and terrorist activity,

current industry practices regarding site security, and the security of transportation

of regulated substances. Finally, Justice was to include recommendations, if any, for

reducing the vulnerability of these facilities to criminal and terrorist activities. The

interim report was to include, at a minimum, preliminary findings from this review,

the methods used to develop the findings, and an explanation of the activities

expected to occur that could cause the findings in the final report to differ from those

in the interim report. The final report was to discuss the complete results of the

review. CSISSFRRA authorized to be appropriated such sums as necessary to carry

out the requirements.

In a separate but related action, the October 2000 Conference report3 on Justice’s

appropriation act for fiscal year 2001 directed Justice to use $600,000 of the Office of

Justice Programs, Justice Assistance appropriation for its National Institute of Justice

to develop, test, and validate a prototype vulnerability assessment methodology to

assess the security of chemical facilities against terrorist and criminal acts, consistent

with the CSISSFRRA requirements.4

As part of our ongoing study of chemical industry security, you asked us to describe

Justice’s actions to comply with the 1999 congressional mandate to review and report

on the vulnerability of chemical facilities. This report responds to that request. As

agreed, we will report early next year on other issues concerning the security of

chemical facilities.

Justice Initiated Actions to Study the Vulnerability of the Chemical Industry

but Has Not Fully Met Its Statutory Requirements

Justice has only partially fulfilled the requirement to review and report on the

vulnerability of chemical facilities to terrorist or criminal attack. Justice prepared

and submitted an interim report to Congress in May 2002. The interim report was

based on observations made at 11 chemical manufacturing facilities Justice visited in

developing a methodology requested by its appropriations conference committee.

The facilities visited represent only a small portion of the 15,000 chemical facilities

subject to the Clean Air Act’s risk management plan provisions. While the interim

report contains the elements required by CSISSFRRA, it was submitted nearly 2 years

after it was due, and the results cannot be generalized to the industry as a whole.

Additionally, Justice did not submit its final report to Congress by August 5, 2002, as

required. Justice told us that because of competing priorities in its budget, it had not

yet conducted a more comprehensive final study. While Justice determined that it

did not have adequate funds to conduct the study of the vulnerability of chemical

facilities to attack, it did not formally request additional funds from Congress for this

purpose in fiscal year 2001 or 2002. Justice has asked for $3 million in its fiscal year

2003 budget request and plans to conduct the study and issue the final report if it

receives these funds. We note that Justice should have used its existing

 3

H.R. Conf. Rept. No. 106-1005, at 223 (2000).

4

The Departments of Commerce, Justice, and State, the Judiciary, and Related Agencies

Appropriations Act for fiscal year 2001, Pub. L. No. 106-553, 114 Stat. 2762, was not enacted until

December 21, 2000.
3 GAO-03-24R Security of Chemical Facilities

appropriations for the study. Generally, when Congress imposes a new requirement

on an agency but does not appropriate funds specifically to implement it, the agency

must use existing appropriations to fund the requirement.5

Justice’s Interim Report Was Based on Observations Made While Developing a

Methodology to Assess Chemical Facilities’ Vulnerability to Terrorist Attack

Justice determined that the first step in meeting the CSISSFRRA requirements was to

develop a methodology to assess the security of chemical facilities. On March 31,

2000, the Justice submitted notice to the House and Senate Committees on

Appropriations that it planned to transfer $750,000 from the Counterterrorism

appropriation to the Office of Justice Programs appropriation to develop a

methodology. According to Justice, the committees disagreed with the transfer and

Justice elected not to proceed with it.

A conference committee later directed Justice to use $600,000 of the Office of Justice

Programs, Justice Assistance appropriation for the department’s National Institute of

Justice to develop, test, and validate a prototype vulnerability assessment

methodology to assess the security of chemical facilities against terrorist and

criminal acts, consistent with the CSISSFRRA requirements.6

In January 2001, Justice, together with the Department of Energy’s Sandia National

Laboratory, began developing, testing, and validating the vulnerability assessment

methodology. The methodology provides a tool to identify risks and mitigate the

consequences of terrorist attacks. In July 2002, Justice made the completed

methodology publicly available to assist chemical companies in identifying and

assessing their threats, risks, and vulnerabilities. In addition, chemical industry

associations are encouraging their members to use this methodology to evaluate their

facilities.

On the basis of observations made during the development of the methodology,

Justice prepared a 12-page interim report to Congress in response to the CSISSFRRA

requirement. Justice determined that the report contains information that if released

would pose a threat to national security and therefore has not made it publicly

available.7

 As required, the interim report (1) provides preliminary findings,

(2) discusses the methods used to develop those findings, (3) includes Justice’s

recommendations for reducing the vulnerability of facilities to terrorist activity, and

(4) explains activities expected to occur that could result in differences between the

findings in the interim and final reports. The interim report does not assess overall

security at chemical facilities, but rather, it provides observations Justice made about

security at a few facilities during the development of the methodology.

 5

See B-195007, July 15, 1980; 46 Comp. Gen. 604 (1967); 15 Comp. Gen. 167 (1935).

6

The October 2000 Conference report on Justice’s appropriation act for fiscal year 2001 directed this

action. Additionally, the Conference report required Justice to submit a report on the findings derived

from the development of the methodology. Justice submitted this report to its appropriations

committees in May 2002.

7

Justice made this determination pursuant to 42 U.S.C. 7412(r)(7)(H)(xi)(III).
4 GAO-03-24R Security of Chemical Facilities

Interim Report’s Preliminary Findings

The interim report discusses two preliminary findings that address the extent to

which the Clean Air Act’s accidental release regulations have resulted in actions that

are effective in detecting, preventing, and minimizing the consequences of releases of

regulated substances that may be caused by criminal and terrorist activity. According

to the report, chemical facilities visited generally had safety and emergency response

measures that could mitigate the consequences of a terrorist attack.8

 The report

further stated that the level of security at chemical facilities is roughly equivalent to

standard security practices found in most industries. However, we could not

determine from our discussions with Justice officials what work was performed to

support this finding, and we are continuing to investigate this issue as part of our

ongoing review.

The interim report also contains nine preliminary findings that cumulatively address

the other required reporting elements—the vulnerability of facilities to criminal and

terrorist activity, current industry site security practices, and the security of

chemicals being transported. These findings address the extent to which the 11

facilities

• conducted facility security assessments,

• had the capability to respond to armed attacks,

• conducted emergency response exercises,

• conducted routine pre-employment background investigations,

• had secure process control systems,

• had secure chemical transportation containers,

• had adequate security measures over transportation of hazardous chemicals,

• received meaningful threat information, and

• had effective facility security systems.

Concerning transportation, Justice officials told us that their observations to date

were limited to the transportation of chemicals within a facility and that a broader

review of transportation vulnerabilities outside a facility is needed.

Methods Used to Develop Preliminary Findings

Justice’s preliminary findings are based on the work that it and Sandia did to develop

the vulnerability assessment methodology. Consequently, the scope and limitations

of the interim report’s preliminary findings are the same as those for the

methodology. In developing the methodology, Justice identified approximately

15,000 U.S. facilities that produce, dispose of, or in some manner handle or use

hazardous chemicals. Justice focused on chemical facilities that manufactured

chemicals hazardous to human life. These were chemicals that, if inhaled or touched

by individuals, would cause harmful or lethal results. To develop and test the

methodology, Justice and Sandia personnel met with industry and government

officials and visited 11 chemical manufacturing facilities from April 2001 through

 8

We only discuss selected information from the interim report that Justice has determined does not

pose a threat to national security.
5 GAO-03-24R Security of Chemical Facilities

January 2002. These facilities were selected in consultation with personnel from the

American Chemistry Council, the chemical manufacturing industry's trade

association, who suggested that the security at these facilities was representative of a

broad range of facilities in the industry. These facilities represented a range of

characteristics such as (1) location—six urban and five rural sites and (2) the number

of employees—three had more than 1,000 employees, three had fewer than 100

employees, and the remaining five ranged from 100 to 1,000 employees. Justice and

Sandia focused primarily on physical security at fixed sites—the security of

electronic chemical process control systems and transportation systems was a

secondary focus.

Because the findings in the interim report are based on visits to only 11 facilities, the

report states that caution should be exercised in generalizing the findings to the

entire industry. However, the report also notes that these visits provided the

department with the opportunity to identify potential threats, overall risks, and

vulnerabilities at these chemical facilities. Also, according to Justice, chemical

facilities that store and use chemicals may present fundamentally different security

concerns than chemical facilities that produce or manufacture chemicals—such as

those included in the Justice study—and that, as such, the preliminary findings and

recommendations may not apply other than to manufacturing facilities. It is

important to note that of the approximately 15,000 facilities covered by the Clean Air

Act, according to an official at the Environmental Protection Agency, only about

1,500 produce or manufacture chemicals.

Interim Report Recommendations

The interim report notes that in addition to the use of effective security systems,

other remedial measures should be considered to lower the probability of a

successful terrorist attack. Justice officials told us that these recommendations

apply to the 11 facilities they visited and may not be applicable to other chemical

facilities. While Justice has not made the recommendations publicly available,

officials said that chemical facilities would be able to identify measures to potentially

lower the probability of a successful terrorist attack when they conduct their own

vulnerability assessments.

Potential Differences Between the Interim and Final Reports

Justice notes that its report is based primarily on information and practices

developed prior to September 11, 2001, and therefore the findings in a final report

may differ in some respects from those in the interim report. Furthermore, some

chemical manufacturers have altered their security measures since September 2001,

and those changes may not be fully reflected in the interim report. According to

Justice officials, Sandia visited five facilities prior to, and six after, September 11,

2001.
6 GAO-03-24R Security of Chemical Facilities

Justice Does Not Plan to Conduct the Study and Issue the Final Report Unless

Congress Provides Requested Funding

According to Justice officials, Justice did not comply with the CSISSFRRA

requirement to issue the final report by August 5, 2002, because it determined that it

did not have adequate funds in its existing budget and Congress has not provided

funds specifically for this purpose.9

 Justice has estimated the study would cost

$7 million, but did not provide the basis for this estimate. And while Justice could not

identify funds to conduct a study of the security of the chemical industry, it did not

ask Congress for funds for this purpose in fiscal year 2001 or 2002, or in the

supplemental appropriations for either year. Justice has requested $3 million as part

of its lump sum appropriation for Salaries and Expenses, General Administration for

fiscal year 2003 for “chemical plant vulnerability assessments.”

10 According to

officials, Justice does not plan to conduct any further work to assess the vulnerability

of the chemical industry, nor does it plan to issue the final report to Congress unless

Congress enacts the lump sum appropriation in the amount Justice has requested.

Nevertheless, while Justice’s appropriations acts have not provided the department

an earmark or a specific line item appropriation for this purpose, Justice does have

appropriations legally available for this purpose. Justice is authorized to use its

existing and available lump sum appropriations for this purpose. Generally, when

Congress imposes a requirement but does not appropriate additional funds to

specifically carry it out, an agency must use an existing appropriation to implement

the requirement—one that is consistent with the purposes of the particular

appropriation being charged for that expense.11

Justice’s interim report recognizes that a vulnerability assessment would help identify

and set priorities for security vulnerabilities at chemical facilities, compare security

risks across chemical facilities, and help companies make the best use of security

funding and other resources to address priority vulnerabilities. Furthermore,

according to the administration’s July 2002 National Strategy for Homeland

Security, comprehensive vulnerability assessments of critical infrastructures enable

authorities to evaluate the potential effects of an attack on a given facility or sector

and to invest accordingly.

Agency Comments and Our Evaluation

We provided a draft of this report to the Department of Justice for its review and

comment. Justice agreed with the majority of the observations contained in the

report. However, Justice expressed concern that we did not place its efforts in the

proper context when we observed that it did not use available funds to address the

comprehensive reporting requirements included in CSISSFRRA. Justice also

explained the notification provisions found in section 605 of its appropriations acts.

 9

 However, CSISSFRRA authorizes such funds as may be necessary to be appropriated to Justice to

conduct the study and report on the vulnerability of chemical facilities.

10Department of Justice, Fiscal Year 2003 Budget Summary, Salaries and Expenses, General

Administration, Department Leadership. 11See B-195007, July 15, 1980; 46 Comp. Gen. 604 (1967); 15 Comp. Gen. 167(1935).
7 GAO-03-24R Security of Chemical Facilities

We recognized the initial efforts Justice made to address the reporting requirements

included in CSISSFRRA. As we stated in our report, Justice has partially addressed

the CSISSFRRA mandate by preparing an interim report. We also reported that

Justice notified the House and Senate Committees on Appropriations that it planned

to transfer $750,000 from its Counterterrorism appropriation to develop a

methodology. This notice explained that this money would fund phase one of its

project to prepare a report required by CSISSFFRA. As Justice explains in its

comments to us, section 605 of its appropriations acts required it to notify the

committees of its proposal to use these funds. As we reported, the appropriations

committees disagreed with this transfer and Justice elected not to proceed. Later, a

conference committee directed Justice to use $600,000 to develop, test, and validate a

prototype vulnerability assessment methodology.

While Justice proposed to use $750,000 in 2000 for the first step in meeting the

CSISSFRRA requirements, it did not attempt to use funds from any other

appropriations or ask Congress for funds to complete a study of the security of the

chemical industry until fiscal year 2003. As we stated in the report, we believe that

when Congress imposes a new requirement on an agency but does not appropriate

funds specifically to implement it, the agency must use existing appropriations to

fund the requirement.

The Department of Justice’s letter to us is contained in enclosure I.

Scope and Methodology

To describe Justice's actions to review the vulnerability of the chemical industry

against criminal and terrorist acts and to fulfill its statutorily mandated reporting

requirements, we reviewed the requirements of the Chemical Safety Information, Site

Security and Fuels Regulatory Relief Act and Justice’s appropriations for fiscal years

2000 to 2003 and interviewed Justice officials. We reviewed a copy of the interim

report Justice submitted to Congress and of the vulnerability assessment

methodology developed by Justice and Sandia. We requested a meeting with the

Justice and Sandia personnel who were directly involved with making the

observations on facility security, which was the basis for the interim report, but to

date, Justice has not provided us access to them. We performed our review from

April 2002 through August 2002 in accordance with generally accepted government

auditing standards.
8 GAO-03-24R Security of Chemical Facilities

- - - -

We are sending copies of this report to interested congressional committees. We also

will make copies available to others upon request. In addition, the report will be

available at no charge on the GAO Web site at http://www.gao.gov.

If you have any questions about this report, please contact me at (202) 512-3841.

Major contributors to this report were Linda Libician, Leigh White, Amy Webbink,

and Joanna McFarland.

John B. Stephenson

Director, Natural Resources and

 Environment

Enclosure
9 GAO-03-24R Security of Chemical Facilities

Enclosure I Enclosure I

Comments from the U.S. Department of Justice
10 GAO-03-24R Security of Chemical Facilities

Enclosure I Enclosure I
11 GAO-03-24R Security of Chemical Facilities

Enclosure I Enclosure I

(360264)