Homeland Security: Federal Action Needed to Address Security Challenges at Chemical Facilities
Published: 2004-02-23T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The events of September 11, 2001, triggered a national re-examination of the security of thousands of industrial facilities that use or store hazardous chemicals in quantities that could potentially put large numbers of Americans at risk of serious injury or death in the event of a terrorist-caused chemical release. GAO was asked to examine (1) available information on the threats and risks from terrorism faced by U.S. chemical facilities; (2) federal requirements for security preparedness and safety at facilities; (3) actions taken by federal agencies to assess the vulnerability of the industry; and (4) voluntary actions the chemical industry has taken to address security preparedness, and the challenges it faces in protecting its assets and operations. GAO issued a report on this work in March 2003 (GAO-03-439).
section_title: What GAO Found
paragraphs: Chemical facilities may be attractive targets for terrorists intent on causing economic harm and loss of life. Many facilities exist in populated areas where a chemical release could threaten thousands. The Environmental Protection Agency (EPA) reports that 123 chemical plants located throughout the nation could each potentially expose more than a million people if a chemical release occurred. To date, no one has comprehensively assessed the security of chemical facilities. No federal laws explicitly require that chemical facilities assess vulnerabilities or take security actions to safeguard their facilities from attack. However, a number of federal laws impose safety requirements on facilities that may help mitigate the effects of a terrorist-caused chemical release. Although EPA believes that the Clean Air Act could be interpreted to require security at certain chemical facilities, the agency has decided not to attempt to require these actions in light of the litigation risk and importance of an effective response to chemical security. Ultimately, no federal oversight or third-party verification ensures that voluntary industry assessments of vulnerability are adequate and that security vulnerabilities are addressed. Currently, the federal government has not comprehensively assessed the chemical industry's vulnerabilities to terrorist attacks. EPA, the Department of Homeland Security (DHS), and the Department of Justice have taken preliminary steps to assist the industry in its preparedness efforts, but no agency monitors or documents the extent to which chemical facilities have implemented security measures. Consequently, federal, state, and local entities lack comprehensive information on the vulnerabilities facing the industry. To its credit, the chemical manufacturing industry, led by its industry associations, has undertaken a number of voluntary initiatives to address security at facilities. For example, the American Chemistry Council, whose members own or operate approximately 1,000, or 7 percent, of the facilities subject to Clean Air Act risk management plan provisions, requires its members to conduct vulnerability assessments and implement security improvements. The industry faces a number of challenges in preparing facilities against attacks, including ensuring that all chemical facilities address security concerns. Despite the industry's voluntary efforts, the extent of security preparedness at U.S. chemical facilities is unknown. In October 2002 both the Secretary of Homeland Security and the Administrator of EPA stated that voluntary efforts alone are not sufficient to assure the public of the industry's preparedness. Legislation is now pending that would mandate chemical facilities to take security steps to protect against the risk of a terrorist attack.

section_title: Letter
paragraphs: Thank you for the opportunity to discuss our work on the security of the  nation’s chemical facilities and the recommendations that we made to  address this issue in our March 2003 report.
As the events of September 11, 2001, showed, terrorists can cause  enormous damage to our country by attacking infrastructure essential to  our economy and jeopardizing public health and safety. Following these  events, the President, in the National Strategy for Homeland Security,  identified the chemical industry as one of 13 sectors critical to the nation’s  infrastructure. Across the nation, thousands of industrial facilities  manufacture, use, or store hazardous chemicals in quantities that could  potentially put large numbers of Americans at risk of injury or death in the  event of a chemical release.
Even before September 11, 2001, protecting chemical facilities was the  shared responsibility of federal, state, and local governments in  partnership with the private sector. However, attention was focused  largely on the risks of accidental, rather than intentional, chemical  releases. Under the Clean Air Act, the Environmental Protection Agency  (EPA) identified 140 toxic and flammable chemicals that pose the greatest  risk to human health and the environment when present in certain  quantities above threshold levels. According to EPA, approximately 15,000  facilities in a variety of industries produce, use, or store one or more of  these chemicals beyond threshold amounts. Under the act, these facilities  must take steps to prevent and prepare for an accidental chemical release,  including developing risk management plans (RMP). These facilities are  referred to as RMP facilities. The events of September 11, 2001, brought  heightened attention to security at chemical facilities and the possibility of  a chemical release caused by a terrorist attack.
The federal government’s role in protecting chemical facilities from  terrorist attacks has been much debated since September 11, 2001.  Initially, EPA had the lead responsibility for chemical security; currently  the Department of Homeland Security (DHS) is the lead federal agency.  For both agencies, public debate has centered on whether the federal  government should impose security requirements on chemical facilities or  whether voluntary industry actions are sufficient. Several legislative  proposals have been introduced that address security measures at  chemical facilities, including provisions giving DHS, or EPA and DHS,  authority to mandate security measures at chemical facilities.
My remarks today will focus on security preparedness at the nation’s  chemical facilities. In particular I will (1) summarize available information  on the threats and risks from terrorism that U.S. chemical facilities face;  (2) describe federal requirements for security preparedness and the safe  management of chemicals at these facilities; (3) describe actions federal  agencies have taken to assess the vulnerability of the chemical industry or  to address security preparedness; and (4) describe voluntary actions the  chemical industry has taken to address security preparedness, and the  challenges it faces in protecting its assets and operations. Our 2003 report  was based on our review of available reports, statutes and regulations, and  industry association documents; interviews with officials from the  Department of Defense, the Department of Justice, EPA, industry  associations including the American Chemistry Council (ACC) and the  Synthetic Organic Chemical Manufacturers Association (SOCMA), and  other chemical industry officials; and selected chemical facility site visits.  We limited our review to stationary chemical facilities and did not address  security concerns surrounding transportation of hazardous chemicals.  Appendix I provides additional information on the processes covered  under the Clean Air Act’s for RMP facilities, by industry sector, and the  residential population surrounding RMP facilities that could be  threatended by a “worst-case” accidental chemical release.
subsections: section_title: Background
paragraphs: Chemical facilities manufacture a host of products—including basic  organic chemicals, plastic materials and resins, petrochemicals, and  industrial gases, to name a few. Other facilities, such as fertilizer and  pesticide facilities, pulp and paper manufacturers, water facilities, and  refineries, also house large quantities of chemicals. EPA has a role in  preventing and mitigating accidental releases at chemical facilities  through, among other things, the RMP provisions of the Clear Air Act.  Under these provisions, EPA identified 140 toxic and flammable chemicals  that, when present above certain threshold amounts, would pose the  greatest risk to human health and the environment if released. According  to EPA, approximately 15,000 facilities in a variety of industries produce,  use, or store one or more of these chemicals beyond threshold amounts.
The 2003 President’s National Strategy for the Physical Protection of  Critical Infrastructures and Key Assets sets forth actions that EPA and  DHS will take to secure the chemical infrastructure. The strategy directs  EPA and DHS to promote enhanced site security at chemical facilities and  review current practices and statutory requirements on the distribution  and sale of certain pesticides and industrial chemicals to help identify  whether additional measures are necessary. DHS is also charged with  continuing to develop the Chemical Sector Information Sharing and  Analysis Center, a partnership with industry to facilitate the collection and  sharing of threat information, by promoting the Center and recruiting  chemical industry constituents to participate. A presidential directive  issued in December 2003 designates DHS as the lead federal agency for  chemical security, a change from national strategies issued in July 2002  and February 2003, which named EPA as the lead.
A number of other critical infrastructures have federal security  requirements. All commercial nuclear power facilities licensed by the  Nuclear Regulatory Commission are subject to a number of security  requirements. The Aviation and Transportation Security Act of 2001  directed the Transportation Security Administration to take over  responsibility for airport screening. The Public Health Security and  Bioterrorism Preparedness and Response Act of 2002 requires community  water systems serving more than 3,300 people to conduct a vulnerability  assessment, prepare an emergency response plan, certify to EPA that the  vulnerability assessment and emergency response plan have been  completed, and provide a copy of the assessment to EPA. To improve  security in our nation’s ports, the regulations implementing the Maritime  Transportation Security Act of 2002 direct vessels and facilities—some of  which are chemical facilities—to develop security plans.
Congress is considering several legislative proposals that would grant  DHS, or DHS and EPA, the authority to require chemical facilities to take  security steps. S. 994 requires the Secretary of Homeland Security to  promulgate regulations specifying which facilities should be required to  conduct vulnerability assessments and to prepare and implement site  security plans, a timetable for completing the vulnerability assessments  and security plans, the contents of plans, and limits on the disclosure of  sensitive information. S. 157 would direct EPA to designate high-priority  chemical facilities based on the threat posed by an unauthorized release  and require these facilities to conduct vulnerability assessments, identify  hazards that would result from a release, and prepare a prevention,  preparedness, and response plan. S. 157 would also require facilities to  send these assessments and plans to EPA. EPA and DHS would jointly  review the assessments and plans to determine compliance. S. 157 would  also require that facilities consider inherently safer practices (referred to  as inherently safer technologies), such as substituting less toxic chemicals.
section_title: An Attack Against Chemical Facilities Could Cause Economic Harm and Loss of Life
paragraphs: Experts agree that chemical facilities present an attractive target for  terrorists intent on causing massive damage because many facilities house  toxic chemicals that could become airborne and drift to surrounding areas  if released. Chemical facilities could also be attractive targets for the theft  of chemicals that could be used to create a weapon capable of causing  harm. Justice has concluded that the risk of an attempt in the foreseeable  future to cause an industrial chemical release is both real and credible. In  fact, according to Justice, domestic terrorists plotted to use a destructive  device against a U.S. facility that housed millions of gallons of propane in  the late 1990s. In testimony on February 6, 2002, the Director of the  Central Intelligence Agency warned of the potential for an attack by al  Qaeda on chemical facilities.
Some chemical facilities may be at higher risk of a terrorist attack than  others because they contain large amounts of toxic chemicals and are  located near population centers. Attacks on such facilities could harm a  large number of people, with health effects ranging from mild irritation to  death, cause large-scale evacuations, and disrupt the local or regional  economy. No specific data are available on what the actual effects of  successful terrorist attacks on chemical facilities would be. However, RMP  facilities must submit to EPA estimates, including the residential  population located within the range of a toxic gas cloud produced by a  “worst-case” chemical release, called the “vulnerable zone.” According to  EPA, 123 chemical facilities located throughout the nation have toxic  “worst-case” scenarios where more than one million people could be at  risk of exposure to a cloud of toxic gas. About 600 facilities could each  potentially threaten between 100,000 and a million people, and about 2,300  facilities could each potentially threaten between 10,000 and 100,000  people within these facilities’ “vulnerable zones.”
According to EPA, “worst-case” scenarios do not consider the potential  causes of a release or how different causes or other circumstances, such  as safety features, could lessen the consequences of a release. Hence, the  “worst-case” scenario calculations would likely be overstating the  potential consequences. However, under the Clean Air Act, RMP facilities  must estimate the effects of a toxic chemical release involving the greatest  amount of the toxic chemical held in a single vessel or pipe—not the entire  quantity on site. Therefore, for some facilities it is conceivable that an  attack where multiple chemical vessels were breached simultaneously  could result in an even larger release, potentially affecting a larger  population than estimated in the RMP “worst-case” scenarios. Other  factors besides location and the quantity of chemicals onsite could also  make a facility a more attractive target. For example, a facility that is  widely recognizable, located near a historic or iconic symbol, or critical to  supporting other infrastructures could be at higher risk. A 2002 Brookings  Institution report ranks an attack on toxic chemical facilities behind only  biological and atomic attacks in terms of possible fatalities.
Currently, no one has comprehensively assessed security across the nation  at facilities that house chemicals. According to a 1999 study by the  Department of Health and Human Services’ Agency for Toxic Substances  and Disease Registry (ATSDR), security at chemical facilities in two  communities was fair to very poor. ATSDR observed security  vulnerabilities such as freely accessible chemical barge terminals and  chemical rail cars parked near residential areas in communities where  facilities are located. Following visits to 11 chemical facilities, Justice  concluded that some facilities may need to implement more effective  security systems and develop alternative means to reduce the potential  consequences of a successful attack. The ease with which reporters and  environmental activists gained access to chemical tanks and computer  centers that control manufacturing processes at chemical facilities in  recent years also raises doubts about security effectiveness at some  facilities.
section_title: No Federal Requirements Specifically Require Chemical Facilities to Address the Threat of Terrorism
paragraphs: No federal laws explicitly require all chemical facilities to take security  actions to safeguard their facilities against a terrorist attack. Although the  federal government requires certain chemical facilities to take security  precautions directed to prevent trespassing or theft, these requirements do  not cover a wide range of chemical facilities and may do little to actually  prevent a terrorist attack. For example, under EPA’s regulations  implementing the Resource Conservation and Recovery Act of 1976,  facilities that house hazardous waste generally must take certain security  actions, such as posting warning signs and using a 24-hour surveillance  system or surrounding the active portion of the facility with a barrier and  controlled entry gates. However, according to EPA, these requirements  would be applicable to only approximately 21 percent of the 15,000 RMP  facilities. Regulations implementing the Maritime Transportation Security  Act of 2002 also require vessels and port facilities—some of which are  chemical facilities—to develop security plans.
A number of federal laws also impose safety requirements on chemical  facilities, but these requirements do not specifically and directly address  security preparedness against terrorism. Several statutes, including the  Occupational Safety and Health Act, the Clean Air Act, and the Emergency  Planning and Community Right-to-Know Act, impose safety and  emergency response requirements on chemical facilities that may  incidentally reduce the likelihood and mitigate the consequences of  terrorist attacks. All of these requirements could potentially mitigate a  terrorist attack in a number of ways. First, because some of these  requirements only apply to facilities with more than threshold quantities of  certain chemicals, facility owners have an incentive to reduce or eliminate  these chemicals, which may make the facility a less attractive target or  minimize the impact of an attack. Second, both the Clean Air Act risk  management plan provisions and the hazard analyses under the  Occupational Safety and Health Act require facility operators to identify  the areas of their facilities that are vulnerable to a chemical release. When  facilities implement measures to improve the safety of these areas, such as  installing sensors and sprinklers, the impact of a terrorist-caused release  may be lessened. Third, the emergency response plans increase  preparedness for a chemical release—whether intentional or  unintentional. While these safety requirements could mitigate the effects  of a terrorist attack, they do not impose any security requirements, such as  conducting vulnerability assessments and addressing identified problems.
While no law explicitly requires facilities to address the threat of  terrorism, EPA believes that the Clean Air Act could be interpreted to  provide it with authority to address site security from terrorist attacks at  chemical facilities. Section 112(r) of the Clean Air Act—added by the  Clean Air Act Amendments of 1990—imposes certain requirements on  chemical facilities with regard to “accidental releases.” The act defines an  accidental release as an unanticipated emission of a regulated substance  or other extremely hazardous substance into the air. Arguably, any  chemical release caused by a terrorist attack would be unanticipated and  thus could be covered under the Clean Air Act. An interpretation of an  unanticipated emission as including an emission due to a terrorist attack  would provide EPA with authority to require security measures or  vulnerability assessments with regard to terrorism. However, EPA has not  attempted to use these Clean Air Act provisions. EPA is concerned that  such an interpretation would pose significant litigation risk. As we  reported in March 2003, there are a number of practical and legal  arguments against this interpretation. We find that EPA could reasonably  interpret its Clean Air Act authority to cover chemical security, but also  agree with the agency that this interpretation could be open to challenges.  At the time of our 2003 review, EPA supported passage of legislation to  specifically address chemical security.
section_title: Federal Agencies Have Not Comprehensively Assessed the Vulnerability of the Chemical Industry to Terrorism, but Have Taken Some Preliminary Steps
paragraphs: Despite a congressional mandate to do so, the federal government has not  conducted the assessments necessary to develop comprehensive  information on the chemical industry’s vulnerabilities to terrorist attacks.  The Chemical Safety Information, Site Security and Fuels Regulatory  Relief Act of 1999 required Justice to review and report on the  vulnerability of chemical facilities to terrorist or criminal attack. In May  2002, nearly 2 years after it was due, Justice prepared and submitted an  interim report to Congress that described observations on security at 11  chemical manufacturing facilities Justice visited to develop a methodology  for assessing vulnerability, but its observations cannot be generalized to  the industry as a whole. In its fiscal year 2003 budget, Justice asked for $3  million to conduct chemical plant vulnerability assessments. In the  February 2003 conference report on Justice’s appropriation act for fiscal  year 2003, Congress directed that $3 million of the funding being  transferred to DHS to be used for the chemical plant vulnerability  assessments. Justice believes that chemical plant vulnerability  assessments are now part of DHS’ mission.
Federal agencies have taken preliminary steps to assist the industry in its  preparedness efforts. While Justice has not assessed the vulnerability of  the chemical industry, it has provided the industry with a tool for  individual facilities to use in assessing their vulnerabilities. Justice,  together with the Department of Energy’s Sandia National Laboratories,  developed a vulnerability assessment methodology for evaluating the  vulnerability to terrorist attack of facilities handling chemicals. The  methodology helps facilities identify and assess threats, risks, and  vulnerabilities and develop recommendations to reduce risk, where  appropriate. As the lead federal agency for the operational response to  terrorism, Justice’s FBI is responsible for weapons of mass destruction  threat assessment and communicating warnings. Finally, agents in the  FBI’s local field offices provide information and technical assistance to  state and local jurisdictions and to some chemical facilities to bolster their  preparedness to respond to terrorist incidents.
EPA has also taken some actions. Officials have analyzed the agency’s  database of RMP facilities to identify high-risk sites for DHS and Justice’s  Federal Bureau of Investigation (FBI). But these facilities are only a  portion of the universe of all industrial facilities that house toxic or  hazardous chemicals. At the time of our review, EPA had not analyzed  non-RMP facilities to determine whether any of those facilities should be  considered at high risk for a terrorist attack. EPA has also issued warning  alerts to the industry, hosted training classes on vulnerability assessment  methodologies, and informally visited about 30 high-risk facilities to learn  about and encourage security efforts. Finally, DHS’ Information Analysis  and Infrastructure Protection directorate collects information from the  U.S. intelligence community, other federal agencies, and the private sector.  Working with ACC, an industry association representing chemical  manufacturers, DHS also supports the Chemical Sector Information  Sharing and Analysis Center to collect and share threat information for the  chemical industry. In addition, according to EPA officials, DHS has begun  identifying high-risk facilities and conducting site visits at facilities.  However, neither EPA nor DHS is currently monitoring the extent to  which the industry has implemented security measures.
section_title: Chemical Industry Has Taken Voluntary Actions to Address Security Concerns but Faces Significant Challenges in Preparing Against Terrorist Attacks
paragraphs: The chemical manufacturing industry has undertaken a number of  voluntary initiatives to address security concerns at chemical facilities,  including developing security guidelines and tools to assess vulnerabilities,  but major challenges remain. All of the industry groups with whom we met  have taken actions such as forming security task forces, holding meetings  and conferences to share security information with members, and  participating in security briefings with federal agencies. In response to the  terrorist attacks on September 11, 2001, ACC—whose members own or  operate approximately 1,000 RMP facilities —-now requires its members,  as a condition of membership, to rank facilities using a screening tool to  evaluate its facilities’ risk level. It also requires facilities to identify, assess,  and address vulnerabilities at facilities using one of several available  vulnerability assessment methodologies. In doing so, ACC member  facilities generally follow a multistep process that includes    evaluating on-site chemical hazards, existing safety and security features,  and the attractiveness of the facility as a terrorist target;    using hypothetical threat scenarios to identify how a facility is vulnerable  to attack; and  identifying security measures that create layers of protection around a  facility’s most vulnerable areas to detect, delay, or mitigate the  consequences of an attack.
ACC established time frames for completing the vulnerability assessment  and implementing security measures, based on the facility’s risk ranking.  ACC reports that the 120 facilities ranked as the highest risk and 372  facilities ranked as the next highest have completed vulnerability  assessments. Most of ACC’s lower-risk facilities are progressing on  schedule. ACC generally requires third-party verification that the facility  has made the improvements identified in its vulnerability assessment.
While these are commendable actions, they do not provide a high level of  assurance that chemical facilities have better protected their facilities  from terrorist attack. First, ACC does not require third parties to verify  that the facility has conducted the vulnerability assessment appropriately  or that its actions adequately address security risks. Even though  compliance with ACC’s safety and security requirements is a condition of  membership, we do not believe that its requirements for facilities to  periodically report on compliance with these requirements is an effective  enforcement measurement because ACC does not verify implementation  or evaluate the adequacy of facility measures. Second, its member  facilities comprise only 7 percent of the facilities required to submit risk  management plans to EPA, leaving about 14,000 other RMP facilities that  may not participate in voluntary security efforts. These facilities include  agricultural suppliers, such as fertilizer facilities; petroleum and natural  gas facilities; food storage facilities; water treatment facilities; and  wastewater treatment facilities, among others. Third, other facilities house  chemicals that EPA has identified as hazardous, but in quantities that are  below the threshold level required to be categorized as RMP facilities.
Other industry groups are also developing security initiatives, but the  extent of these efforts varies from issuing security guidance to requiring  vulnerability assessments. For example, the American Petroleum Institute,  which represents petroleum and natural gas facilities, published security  guidelines developed in collaboration with the Department of Energy that  are tailored to the differing security needs of industry sectors. Despite  industry associations’ efforts to encourage security actions at facilities, the  extent of participation in voluntary initiatives is unclear. EPA officials  estimate that voluntary initiatives led by industry associations only reach a  portion of the 15,000 RMP facilities. Furthermore, EPA officials stated that  these voluntary initiatives raise an issue of accountability, since the extent  to which industry group members are implementing voluntary initiatives is  unknown.
The chemical industry faces a number of challenges in preparing facilities  against terrorist attacks, including ensuring that facilities obtain adequate  information on threats and determining the appropriate security measures  given the level of risk. Trade association and industry officials identified a  number of concerns about preparing against terrorist attacks. First,  industry officials noted that they need better threat information from law  enforcement agencies, as well as better coordination among agencies  providing threat information. Second, industry officials report that  chemical companies face a challenge in achieving cost-effective security  solutions, noting that companies must weigh the cost of implementing  countermeasures against the perceived reduction in risk. Industry groups  with whom we spoke indicated that their member companies face the  challenge of effectively allocating limited security resources. Third,  facilities face pressure from public interest groups to implement  inherently safer practices (referred to in the industry as inherently safer  technologies), such as lowering toxic chemical inventories and  redesigning sites to reduce risks. Justice has also recognized that reducing  the quantity of hazardous material may make facilities less attractive to  terrorist attack and reduce the severity of an attack. While industry  recognizes the contribution that inherently safer technologies can make to  reducing the risk of a terrorist attack, industry officials noted that  decisions about inherently safer technologies require thorough analysis  and may shift, rather than reduce, risks. Finally, industry officials stated  that the industry faces a challenge in engaging all chemical facilities in  voluntary security efforts. ACC has made efforts to enlist facilities beyond  its membership in voluntary security initiatives. The Synthetic Organic  Chemical Manufacturers’ Association (SOCMA) adopted ACC’s security  code for its member facilities as a condition of membership. However, the  extent to which all partnering companies and associations implement the  requirements is unclear.
Mr. Chairman, this concludes my prepared statement. I would be happy to  respond to any questions that you or Members of the Subcommittee may  have.
section_title: Contacts and Acknowledgements
paragraphs: For further information about this testimony, please contact me at (202)  512-3841. Joanna Owusu, Vince Price, Carol Herrnstadt Shulman, and Amy  Webbink made key contributions to this statement.
section_title: Appendix I: RMP-Covered Industrial Processes and Off-Site Consequences of Worst-Case Chemical Releases
paragraphs: This appendix presents information on the processes covered under the  Clean Air Act’s requirements for risk management plan (RMP) facilities by  industry sector and the residential population surrounding RMP facilities  that could be threatened by a “worst-case” accidental chemical release.