Homeland Security: DHS Is Addressing Security at Chemical Facilities, but Additional Authority Is Needed
Published: 2006-06-21T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Terrorist attacks on U.S. chemical facilities could damage public health and the economy. The Department of Homeland Security (DHS) coordinates federal efforts to protect these facilities from attacks. GAO was asked to provide a statement for the record based on its report Homeland Security: DHS Is Taking Steps to Enhance Security at Chemical Facilities, but Additional Authority Is Needed ( GAO-06-150 , January 27, 2006), GAO reviewed (1) DHS's actions to develop a strategy to protect chemical plants, assist with the industry's security efforts, and coordinate with other federal agencies, (2) industry security initiatives, (3) DHS's authorities and the need for additional security legislation, and (4) stakeholders' views on any requirements to use safer technologies.
section_title: What GAO Found
paragraphs: DHS is developing a Chemical Sector-Specific Plan, which is intended to, among other things, describe DHS's ongoing efforts and future plans to coordinate with federal, state, and local agencies and the private sector; identify chemical facilities to include in the sector, assess their vulnerabilities, and prioritize them; and develop programs to prevent, deter, mitigate, and recover from attacks on chemical facilities. DHS officials told GAO that they now expect to complete and release the plan in the fall of 2006. In addition, DHS has taken a number of actions to protect the chemical sector from terrorist attacks. DHS identified 3,400 facilities that, if attacked, could pose the greatest hazard to human life and health and has initiated programs to assist the industry and local communities in protecting chemical plants. DHS also coordinates with the Chemical Sector Coordinating Council, an industry-led group that acts as a liaison for the chemical sector, and with EPA and other federal agencies. The chemical industry is voluntarily addressing plant security, but faces challenges. Some industry associations require member companies to assess plants' vulnerabilities, develop and implement mitigation plans, and have a third party verify that security measures were implemented. Other associations have developed guidelines and other tools to encourage their members to address security. Industry officials said that high costs and limited guidance on how much security is adequate create challenges in preparing facilities against terrorism. Because existing laws provide DHS with only limited authority to address security at chemical facilities, it has relied primarily on the industry's voluntary security efforts. However, the extent to which companies are addressing security is unclear. DHS does not have the authority to require chemical facilities to assess their vulnerabilities and implement security measures. Therefore, DHS cannot ensure that facilities are taking these actions. DHS has stated that its existing authorities do not permit it to effectively regulate the chemical industry, and that the Congress should enact federal requirements for chemical facilities. Many stakeholders agreed--as GAO concluded in 2003 and again in January 2006--that additional legislation placing federal security requirements on chemical facilities is needed. Stakeholders had mixed views on whether any chemical security legislation should require plants to substitute safer chemicals and processes, which could lessen the potential consequences of an attack, but could be costly or infeasible for some plants. DHS has stated that safer practices may make facilities less attractive to terrorist attack, but may shift risks rather than eliminate them. Environmental groups told GAO that they favored including or considering inherently safer technologies in any federal requirements, but most industry officials GAO contacted opposed a requirement to use safer technologies because they may shift risks or be prohibitively expensive.

section_title: Letter
paragraphs: We are pleased to have the opportunity to present the results of our recent  work on chemical facility security. As we reported in January 2006, across  the nation, approximately 15,000 facilities produce, use, or store more  than specific maximum amounts of chemicals that the Environmental  Protection Agency (EPA) has identified as posing the greatest risk to  human health and the environment if accidentally released into the air.  These facilities include chemical manufacturers, storage and distribution  facilities, water and wastewater treatment facilities, and refineries, among  others. Since September 11, 2001, government and other experts have  recognized the potential threat that chemical facilities pose because many  house toxic chemicals that could become airborne and drift to  surrounding areas or be used to create a chemical weapon capable of  causing harm. While these facilities potentially put large numbers of  Americans at risk of injury or death in the event of a chemical release, the  chemicals they produce, use, store, and distribute are critical to the  nation’s economy.
The Homeland Security Act of 2002 established the Department of  Homeland Security (DHS) and set forth its mission to, among other things,  prevent terrorist attacks in the United States and reduce the vulnerability  of the nation to terrorism. The President’s February 2003 National  Strategy for the Physical Protection of Critical Infrastructures and Key  Assets sets forth the federal government’s roles, objectives, and  responsibilities in protecting the nation’s critical infrastructure, including  the chemical industry. In addition, a December 2003 presidential directive  instructed DHS to produce a comprehensive integrated plan outlining  national goals, objectives, milestones, and key initiatives for protecting  critical infrastructure and key resources. The directive also named DHS as  the lead agency for the chemical sector.  Under an interim national plan  released in February 2005, DHS is to identify and prioritize critical  chemical facilities, evaluate the chemical sector’s vulnerabilities and risks,  develop and implement protective programs for high-priority chemical  facilities, identify regulatory options for protective measures, and maintain  a relationship with all stakeholders.
The federal government’s role in protecting chemical facilities from  terrorist attacks has been much debated since September 11, 2001. Public  debate has centered on whether the federal government should impose  security requirements on chemical facilities or continue to work with the  chemical industry to voluntarily address security concerns. Legislative  proposals that would grant DHS or EPA, or one of these agencies in  consultation with the other, the authority to require chemical facilities to  take security steps were introduced in every Congress from 2001 to 2005.  Provisions in legislative proposals that would require chemical facilities to  implement or consider the substitution of safer chemicals and processes— referred to as “inherently safer technologies”—have also sparked debate.  Appendix I provides an overview of key chemical security legislative  proposals in the 109th Congress, two of which contain provisions relating  to the use of inherently safer technologies.
My statement today is based on our January 2006 report, and will focus on  (1) DHS’ actions to develop a plan for protecting the chemical sector,  assess facilities’ vulnerabilities, and interact with the industry and other  federal agencies; (2) chemical industry security initiatives and challenges;  (3) DHS’ existing authorities and whether additional legislative authority is  needed; and (4) stakeholders’ views on the inclusion of an inherently safer  technologies requirement in any legislation. In conducting our work, we  interviewed officials from DHS and EPA and reviewed pertinent federal  legislation, EPA data, DHS documents, and other available reports. We  also interviewed representatives of all 16 associations participating on the  Chemical Sector Coordinating Council, a group of chemical sector  associations that facilitate the sharing of industry views with DHS, and  spoke with at least one member company belonging to 13 of the key  chemical industry associations. We also interviewed other organizations  with chemical industry expertise, including the American Society of  Mechanical Engineers, the Center for Chemical Process Safety, Sandia  National Laboratories, and the Working Group on Community Right-to- Know, among others. We conducted our work according to generally  accepted government auditing standards.
subsections: section_title: Background
paragraphs: Experts agree that chemical facilities are among the most attractive  targets for terrorists intent on causing massive damage. Despite the risk  these facilities pose, no one has yet comprehensively assessed security at  the nation’s chemical facilities. EPA regulates about 15,000 facilities under  the 1990 amendments to the Clean Air Act because they produce, use, or  store more than certain threshold amounts of specific chemicals that  would pose the greatest risk to human health and the environment if they  were accidentally released into the air. These facilities must take a number  of steps, including preparing a risk management plan (RMP), to prevent  and prepare for an accidental release and, therefore, are referred to as  RMP facilities. These facilities fall within a variety of industries and  produce, use, or store a variety of products, including basic chemicals;  specialty chemicals, such as solvents; life science chemicals, such as  pharmaceuticals and pesticides; and consumer products, such as  cosmetics. Some of these facilities are part of critical infrastructure  sectors other than the chemical sector. For example, about 2,000 of these  facilities are community water systems that are part of the water  infrastructure sector. In addition, other facilities that house hazardous  chemicals that are listed under the RMP regulations are not subject to  RMP requirements because the quantities stored or used are below  threshold amounts. Through the RMP program, EPA has gained extensive  expertise with chemical facilities and processes that could be useful in  helping DHS assess security issues.
Federal requirements currently address security at some U.S. chemical  facilities. For example, a small number of chemical facilities must comply  with the Maritime Transportation Security Act of 2002 and its  implementing regulations, which require maritime facility owners and  operators to conduct assessments, develop security plans, and implement  security measures. In addition, certain community water systems—while  not specifically considered chemical facilities but which use and store  large volumes of chemicals—are required by the Public Health Security  and Bioterrorism Preparedness and Response Act of 2002 to conduct and  submit a vulnerability assessment to EPA and prepare an emergency  response plan that incorporates the results of the assessment. According  to EPA, 1,928 drinking water facilities that are also subject to EPA’s RMP  program must comply with this act. Some states and localities have also  created security requirements at chemical facilities.
In addition, the federal government imposes safety and emergency  response requirements on chemical facilities that may incidentally reduce  the likelihood and consequences of terrorist attacks. For example, Section  112(r) of the Clean Air Act includes a general duty clause directing owners  and operators of facilities to identify hazards, design and maintain a safe  facility to prevent releases, and minimize the consequences of any  accidental releases that occur.  Under Section 112(r), RMP facilities must  also implement a program to prevent accidental releases that includes  safety precautions and maintenance, and monitoring and training  measures, and they must have an emergency response plan. The  Department of Labor’s Occupational Safety and Health Administration’s  process safety management standard also requires facilities to conduct  analyses of their chemical processes which must address hazards of the  process, engineering and administrative controls applicable to the hazards,  facilities siting, and evaluation of the possible health and safety effects of  failures of controls on employees.
section_title: DHS Has Taken Actions to Develop a Plan for Protecting the Chemical Sector, Assess Facilities’ Vulnerabilities, and Interact with the Industry and Other Federal Agencies
paragraphs: DHS is developing a plan for protecting the chemical sector that will  establish a framework for reducing the overall vulnerability of the sector  in partnership with the industry and state and local authorities. At the time  of our review, DHS did not provide a specific date for completion of the  Chemical Sector-Specific Plan. DHS completed a draft of the plan in July  2004 and has been working to revise it to accommodate changes to DHS’s  risk management strategy and comments from stakeholders. DHS officials  told us that the final plan—which they now expect to complete and  release in the fall of 2006—will reflect the basic principles and content  described in the draft plan. On the basis of our review of the draft plan and  discussions with DHS officials, the final plan will, among other things, (1)  present background information on the sector; (2) describe the process  DHS will use to develop an inventory of chemical sector assets; (3)  describe DHS’s efforts to identify and assess chemical facilities’  vulnerabilities and plans to prioritize these efforts on the basis of the  vulnerability assessments; (4) outline the protective programs that will be  created to prevent, deter, mitigate, and recover from attacks on chemical  facilities, and describe how DHS will work with private sector and  government entities to implement these programs; (5) explain the  performance metrics DHS will use to measure the effectiveness of DHS  and industry security efforts; and (6) outline the department’s challenges  in coordinating the efforts of the chemical sector.
DHS has also initiated actions to identify the chemical sector’s critical  assets, prioritize facilities, develop and implement protective programs,  exchange information with the private sector, and coordinate efforts with  EPA and other federal agencies. DHS is focusing its efforts for the  chemical sector by identifying high-priority facilities. As a starting point,  DHS has adapted EPA’s RMP database of facilities with more than  threshold amounts of certain chemicals to develop an interim inventory of  3,400 chemical facilities that pose the greatest hazard to human life and  health in the event of a terrorist attack. These are facilities where a worst- case scenario release potentially could affect over 1,000 people. According  to DHS, 272 of these facilities could potentially affect more than 50,000  people.
DHS is also developing a new risk assessment methodology to compare  and prioritize all critical infrastructure assets according to their level of  threat, their vulnerability to attack, and the consequences of an attack on  the facility. According to DHS, Risk Analysis Management for Critical  Asset Protection (RAMCAP) will provide a common methodology,  terminology, and framework for homeland security risk analysis and  decision making that is intended to allow consistent risk management  across all sectors. The RAMCAP process entails chemical facility  owners/operators voluntarily completing a screening tool to identify the  consequences of an attack. On the basis of the results of the screening  tool, DHS will identify facilities of highest concern and ask them to  voluntarily complete a security vulnerability assessment.
Finally, DHS has implemented a number of programs to assist the private  sector and local communities in reducing vulnerabilities. For example,  DHS works with local law enforcement officials and facility owners  through the Buffer Zone Protection Program to improve the security of the  area surrounding a facility. To assess and identify vulnerabilities at  chemical facilities, DHS deploys teams of experts from both government  and industry to conduct a site assistance visit. DHS had conducted 38 site  assistance visits at chemical facilities as of June 15, 2005, and planned to  conduct additional visits in fiscal year 2006 on the basis of need. DHS has  also installed cameras at some high-consequence facilities, providing local  law enforcement authorities with the ability to conduct remote  surveillance and allowing state homeland security offices and DHS to  monitor the facilities. In addition, DHS distributes threat information to  the industry through various means and coordinates sector activities with  the Chemical Sector Coordinating Council, an industry-led working group  formed voluntarily by trade associations that acts as a liaison for the  chemical sector. DHS also coordinates with EPA and other federal  agencies through a government coordinating council. EPA officials believe  that the agency could further assist DHS by providing analytical support in  identifying high-risk facilities that should be targeted in DHS’ chemical  sector efforts, among other activities.
section_title: The Chemical Industry Continues Voluntary Efforts to Address Security, but Faces Challenges in Safeguarding Facilities
paragraphs: With few federal security requirements, industry associations have been  active in promoting security among member companies. Some industry  associations, including the American Chemistry Council (ACC), the  Synthetic Organic Chemical Manufacturers Association, and the National  Association of Chemical Distributors, require member companies to  assess their facilities’ vulnerabilities and make security enhancements,  requiring as a condition of membership that they conduct security  activities and verify that these actions have been taken. ACC, representing  135 chemical manufacturing companies with approximately 2,000  facilities, has led the industry’s efforts to improve security at their  facilities. ACC requires its members to adhere to a set of security  management principles that include performing physical security  vulnerability assessments using an approved methodology, developing  plans to mitigate vulnerabilities, taking actions to implement the plans,  and having an independent party such as insurance representatives or  local law enforcement officials verify that the facilities implemented the  identified physical security enhancements. These reviewers do not verify  that a vulnerability assessment was conducted appropriately or that  actions taken by a facility adequately address security risks. However,  ACC requires member companies to periodically conduct independent  third-party audits that include an assessment of their security programs  and processes and their implementation of corrective actions. In addition,  ACC members must take steps to secure cyber assets, such as computer  systems that control chemical facility operations, and the distribution  chain from suppliers to customers, including transportation.
Other industry associations have encouraged their members to address  security by a variety of means. Most of the 16 associations we spoke to  have developed security guidelines and best practices. For example, the  International Institute of Ammonia Refrigeration, representing facilities  such as food storage warehouses, developed site security guidelines  tailored to ammonia refrigeration facilities and provides information about  security resources to members. Several industry associations have also  developed vulnerability assessment methodologies to assist their member  companies in evaluating security needs. For example, the National  Petrochemical and Refiners Association, in partnership with the American  Petroleum Institute, developed a vulnerability assessment methodology  tailored to refiners and petrochemical facilities. Despite industry  associations’ efforts to encourage or require members to voluntarily  address security, the extent of participation in the industry’s voluntary  initiatives is unclear.
Chemical industry officials told us they face a number of challenges in  preparing facilities against a terrorist attack. Most of the chemical  associations we contacted stated that the cost of security improvements is  a challenge for some chemical companies. For example, ACC reports that  its members have spent an estimated $2 billion on security improvements  since September 11, 2001. Representatives of the American Forest & Paper  Association and the National Paint and Coatings Association told us that  small companies, in particular, may struggle with the cost of security  improvements or the cost of complying with any potential government  security programs because they may lack the resources larger companies  have to devote to security. Industry stakeholders also cited the need for  guidance on what level of security is adequate. While DHS has issued  guidance to state Homeland Security Offices and the Chemical Sector  Coordinating Council on vulnerabilities and protective measures that are  common to most chemical facilities, several stakeholders expressed a  desire for guidance on specific security improvements. For example,  representatives of the National Petrochemical and Refiners Association  stated that one reason the association holds workshops and best practices  sessions is to meet the challenge of determining the types of security  measures that constitute a reasonable amount of security.
In addition, industry officials told us that the lack of threat information  makes it difficult for companies to know how to protect facilities. A few  industry officials also mentioned limited guidance on conducting  vulnerability assessments and difficulty in conducting employee  background checks as challenges. One industry association stated that it  would like its members to receive guidance from DHS on how to conduct  vulnerability assessments. Another association expressed frustration  because none of the current vulnerability assessment tools address issues  specific to their member facilities, which package and distribute  chemicals, and it would like DHS to help develop or approve a  methodology for this type of facility. Finally, a number of stakeholders we  contacted told us that emergency response preparedness is a challenge for  chemical companies. An official with an industry-affiliated research center  asserted that emergency responders and communities in the United States  are prepared to respond to a toxic release. However, other stakeholders  we spoke with stated that many facilities have conducted security  vulnerability assessments but may not have done enough emergency  response planning and outreach to the responders and communities that  would be involved in a release. A 2004 survey by a chemical workers union  of workers at 189 RMP facilities found that only 38 percent of respondents  indicated that their companies’ actions in preparing to respond to a  terrorist attack were effective, and 28 percent reported that no employees  at their facilities had received training about responding to a terrorist  attack since September 11, 2001. While environmental laws require  emergency response planning for accidental chemical releases, several  stakeholders told us facilities need to consider very different scenarios  with consequences on different orders of magnitude when planning the  emergency response for a terrorist incident.
section_title: DHS Needs Additional Authority to Ensure That Chemical Facilities Are Addressing Security Issues
paragraphs: Existing laws give DHS limited authority to address chemical sector  security, but DHS currently lacks specific authority to require all high-risk  facilities to assess their vulnerabilities and take corrective actions, where  needed. A number of existing laws outline DHS’s responsibilities for  coordinating with the private sector and obtaining information on and  protecting critical infrastructure, but these laws provide DHS with only  limited authority to address security concerns at U.S. chemical facilities.  For example, under the Homeland Security Act, the Secretary of DHS is  responsible for coordinating homeland security issues with the private  sector to ensure adequate planning, equipment, training, and exercise  activities. Furthermore, the Act gives DHS’s Under Secretary for  Information Analysis and Infrastructure Protection (IAIP) responsibilities  related to protecting critical infrastructure, including    accessing, receiving, analyzing, and integrating information from federal,  state, and local governments and private sector entities to identify, detect,  and assess the nature and scope of terrorist threats to the United States;   carrying out comprehensive assessments of the vulnerabilities of the  nation’s key resources and critical infrastructure;   developing a comprehensive national plan for securing the nation’s key  resources and critical infrastructure; and  recommending the necessary measures to protect these key resources and  critical infrastructure.
DHS does not currently have the authority to require all chemical facilities  to conduct vulnerability assessments or to enter chemical facilities  without their permission to assess security or to require and enforce  security improvements. There is also no legislation requiring chemical  facilities to provide information about their security and vulnerabilities.  Furthermore, except with respect to certain chemical facilities covered  under federal security requirements for other critical infrastructures,  existing laws do not give DHS the right to enter a chemical facility to  assess its vulnerability to a terrorist attack or the authority to require and  enforce the implementation of any needed security improvements at these  facilities. The Homeland Security Act, with some limited exceptions, does  not provide any new regulatory authority to DHS and only transferred the  existing regulatory authority of any agency, program, or function  transferred to DHS, thereby limiting actions DHS might otherwise be able  to take under the Homeland Security Act. Therefore, DHS has relied  solely on the voluntary participation of the private sector to address  facility security. As a result, DHS cannot ensure that all high-risk facilities  are assessing their vulnerability to terrorist attacks and taking corrective  action, where necessary.
DHS has concluded that its existing patchwork of authorities does not  permit it to regulate the chemical industry effectively, and that the  Congress should enact federal requirements for chemical facilities.  Echoing public statements by the Secretary of Homeland Security and the  Administrator of EPA in 2002 that voluntary efforts alone are not sufficient  to assure the public of the industry’s preparedness, in June 2005, both DHS  and EPA called for legislation to give the federal government greater  authority over chemical facility security. Similarly, we concluded in 2003,  and continue to believe, that additional federal legislation is needed  because of the significant risks posed by thousands of chemical facilities  across the country to millions of Americans and because the extent of  security preparedness at these facilities is unknown.
In testimony before the Congress in June 2005, the Acting Undersecretary  for IAIP stated that any proposed regulatory structure (1) must recognize  that not all facilities within the chemical sector present the same level of  risk, and that the most scrutiny should be focused on those facilities that,  if attacked, could endanger the greatest number of lives, have the greatest  impact on the economy, or present other significant risks; (2) should be  based on reasonable, clear, equitable, and measurable performance  standards; and (3) should recognize the progress that responsible  companies have made to date. He also stated that the performance  standards should be enforceable and based on the types and severity of  potential risks posed by terrorists, and that facilities should have the  flexibility to select among appropriate site-specific security measures that  will effectively address those risks. In addition, he said that DHS would  need the ability to audit vulnerability assessment activities and a  mechanism to ensure compliance with requirements.
section_title: Stakeholders’ Views on Safer Technologies Requirement in Chemical Security Legislation Are Mixed
paragraphs: While many stakeholders—including representatives from industry,  research centers, and government—agreed on the need for additional  legislation that would place federal security requirements on chemical  facilities, they expressed divergent views on whether such legislation  should require the use of inherently safer technologies. Implementing  inherently safer technologies could potentially lessen the consequences of  an attack by reducing the chemical risks present at facilities. The  Department of Justice, in introducing a methodology to assess chemical  facilities’ vulnerabilities, recognized that reducing the quantity of  hazardous material may make facilities less attractive to terrorist attack  and reduce the severity of an attack. Furthermore, DHS’s July 2004 draft  Chemical Sector-Specific Plan states that inherently safer chemistry and  engineering practices can prevent or delay a terrorist incident, noting that  it is important to make sure that facility owners/operators consider  alternate ways to reduce risk, such as using inherently safer design,  implementing just-in-time manufacturing, or replacing high-risk chemicals  with safer alternatives. However, DHS told us that the use of inherently  safer technologies tends to shift risks rather than eliminate risks, often  with unintended consequences. Some previous chemical security  legislative proposals have included a requirement that facility security  plans include safer design and maintenance actions, or that facility  security plans include “consideration” of alternative approaches regarding  safer design.
Representatives from three environmental groups told us that facilities  have defined security too narrowly, without focusing on reducing facility  risks through safer technologies. Noting that no existing laws require  facilities to analyze inherently safer options, these representatives believe  legislation should require such an analysis and give DHS or EPA the  authority to require the implementation of technologies if high-risk  facilities are not doing so. Process safety experts at one research  organization recognized that reducing facility hazards and the potential  consequences of chemical releases makes facilities less vulnerable to  attack. However, these experts also explained that inherently safer  technologies can be prohibitively expensive and can shift risks onto other  facilities or the transportation sector. For example, reducing the amount  of chemicals stored at a facility may increase reliance on rail or truck  shipments of chemicals. However, the substitution of chemicals such as  liquid bleach for chlorine gas at drinking water facilities reduces overall  risks. These experts support legislative provisions requiring analysis or  consideration of technology options but do not support giving the federal  government the authority to require specific technology changes because  of the complexity of these decisions. Representatives of two research  centers affiliated with the industry told us that while facilities should look  at inherently safer technologies when assessing their vulnerability to  terrorist attack, safer technologies are not a substitute for security.
Industry associations and company officials were strongly opposed to any  requirements to use inherently safer technologies. The majority of the  industry officials we contacted opposed an inherently safer technologies  requirement, with many stating that inherently safer technologies involve a  safety issue that is unrelated to facility security. Industry officials voiced  concerns about the federal government’s second-guessing complex safety  decisions made by facility process safety engineers. Representatives from  four associations and two companies told us that, in many cases, it is not  feasible to substitute safer chemicals or change to safer processes. Certain  hazardous chemicals may be essential to necessary chemical processes,  while changing chemical processes may require new chemicals that carry  different risks. In July 2005 testimony before the Congress, a Synthetic  Organic Chemical Manufacturers Association representative explained  that while inherently safer technologies are intended to reduce the overall  risks at a facility, they could do so only if a chemical hazard was not  displaced to another time or location or did not magnify another hazard.  Furthermore, process safety experts and representatives from associations  and companies report that some safer alternatives are extremely  expensive. For example, reducing facility chemical inventories by moving  to on-site manufacturing when chemicals are needed can cost millions of  dollars, according to a stakeholder. One company also voiced opposition  even to a legislative requirement that facilities “consider” safer options.  The official explained that the company opposed such a provision—even if  legislation does not explicitly give the government the authority to require  implementation of safer technologies—because it might leave companies  liable for an accident that might have been prevented by a technology  option that was considered but not implemented.
section_title: Conclusions
paragraphs: Despite voluntary efforts by industry associations and a number of DHS  programs to assist companies in protecting their chemical facilities, the  extent of security preparedness at U.S. chemical facilities remains largely  unknown. DHS does not currently have the authority to require the  chemical industry to take actions to improve their security. On this basis,  DHS has concluded—as we did in 2003 and again in January 2006—that its  existing authorities do not allow it to effectively regulate chemical sector  security. Since 2002, both DHS and EPA have called for legislation creating  security requirements at chemical facilities, and legislation has been  introduced without success in every Congress since September 11, 2001.  By granting DHS the authority to require high-risk chemical facilities to  take security actions, policy makers can better ensure the preparedness of  the chemical sector. Furthermore, implementing inherently safer  technologies potentially could lessen the consequences of a terrorist  attack by reducing the chemical risks present at facilities, thereby making  facilities less attractive targets. However, substituting safer technologies  can be prohibitively expensive and can shift risks onto other facilities or  the transportation sector. Also, in many cases, it may not be feasible to  substitute safer chemicals or change to safer processes. Therefore, given  the possible security and safety benefits as well as the potential costs to  some companies of substituting safer technologies, a collaborative study  employing DHS’s security expertise and EPA’s chemical expertise could  help policy makers determine the appropriate role of safer technologies in  facility security efforts.
section_title: Contacts and Acknowledgments
paragraphs: For further information about this statement, please contact John B.  Stephenson at (202) 512-3841. Karen Keegan, Omari Norman, Joanna  Owusu, Vincent P. Price, and Leigh White made key contributions to this  statement.
section_title: Appendix I: Overview of Key Chemical Security Legislative Proposals in the 109th Congress
paragraphs: Since 2001, the Congress has considered a number of legislative proposals  that would give the federal government a greater role in ensuring the  protection of the nation’s chemical facilities. These legislative proposals  would have granted DHS or EPA, or one of these agencies in consultation  with the other, the authority to require chemical facilities to conduct  vulnerability assessments and implement security measures to address  their vulnerabilities. In the 109th Congress, five bills have been introduced  but have not yet been acted upon: H.R. 1562, H.R. 2237, S. 2145, H.R. 4999,  and S. 2486.
High-priority facilities would be  required to submit vulnerability  assessments and security plans to  DHS; other chemical sources  would be required to self-certify  completion of assessments and  plans and provide DHS copies  upon request.
High-priority facilities would be  required to submit vulnerability  assessments and to certify that they  have prepared prevention,  preparedness, and response plans  to EPA.
Designated chemical sources would be  required to submit vulnerability  assessments, security plans, and  emergency response plans to DHS. The  assessment and security plan would be  required to address security performance  standards established by DHS for each  risk-based tier. Chemical sources would  be required to self-certify completion of  assessments and plans.
DHS, in consultation with EPA,  would identify high-priority  categories of facilities; DHS would  receive and review assessments  and plans.
EPA, in consultation with DHS and  state and local agencies, would  identify high-priority categories of  facilities; EPA would receive  assessments and certifications.
DHS would designate facilities as  chemical sources and assign each  chemical source to a risk-based tier. DHS  would receive and review assessments,  plans and certifications. EPA would have  no role.
DHS would, when and where it  deems appropriate, conduct or  require the conduct of vulnerability  assessments and other activities  to ensure and evaluate  compliance; DHS could disapprove  a vulnerability assessment or site  security plan; following written  notification and consultation with  the owner or operator, DHS could  issue a compliance order.
Not later than 3 years after the  deadline for submission of  vulnerability assessments and  response plans, EPA, in consultation  with DHS, would review and certify  compliance of each assessment and  plan; following consultation with  DHS, and 30 days after providing  notification to the facility and  providing advice and technical  assistance to bring the assessment  or plan into compliance and address  threats, EPA could issue a  compliance order.
DHS would review and approve or  disapprove all vulnerability assessments,  security plans, and emergency response  plans for facilities in higher risk tiers within  one year, and within five years for all  other facilities. DHS would be required to  disapprove of any vulnerability  assessment, site security plan, or  emergency response plan not in  compliance with the vulnerability  assessment, site security plan, and  emergency response plan requirements.  For higher risk facilities, if DHS  disapproves the assessment or plans, the  Secretary could issue an order to a  chemical source to cease operation. For  other facilities, the Secretary could issue  an order to a chemical source to cease  operation, but only after a process of  written notification, consultation and time  for compliance.
Would provide for court awarded  civil penalties up to $50,000 per  day for failure to comply with an  order, site security plan, or other  recognized procedures, protocols,  or standards, and administrative  penalties up to $250,000 for failure  to comply with an order.
Would provide for court awarded  civil penalties up to $25,000 per day,  criminal penalties, and  administrative penalties (if the total  civil penalties do not exceed  $125,000) for failure to comply with  an order.
Would provide for court awarded civil  penalties up to $50,000 per day, and  administrative penalties of not more than  $25,000 per day (not to exceed $1 million  per year) for failure to comply with a DHS  order or directive issued under the act.  Also calls for criminal penalties of up to  $50,000 in fines per day, imprisonment for  not more than two years, or both for  knowingly violating an order or failing to  comply with a site security plan.
Response plans would be required  to include a description of safer  design and maintenance options  considered and reasons those  options were not implemented; EPA  would be required to establish a  clearinghouse for information on  inherently safer technologies and  would be authorized to provide  grants to assist chemical facilities  demonstrating financial hardship in  implementing inherently safer  technologies.
None.
Would exempt information  obtained from disclosure under the  Freedom of Information Act (FOIA)  or otherwise, or from disclosure  under state or local laws;  information would also not be  subject to discovery or admitted  into evidence in any federal or  state civil judicial or administrative  procedure other than in civil  compliance action brought by  DHS. Calls for DHS, in  consultation with others, to  establish confidentiality protocols.
Would exempt information obtained  from disclosure under FOIA; calls for  EPA, in consultation with DHS, to  establish information protection  protocols.
Would exempt information obtained from  disclosure under FOIA, or from disclosure  under state or local laws. Certifications  submitted by the chemical sources, orders  for failure to comply, and certificates of  compliance and other orders would  generally be made available to the public.  Calls for DHS, in consultation with the  Director of the Office of Management and  Budget and appropriate federal law  enforcement officials, to create  confidentiality protocols for the  maintenance and use of records; would  establish penalties for the unlawful  disclosure of protected information.
Upon petition, DHS would be  required to endorse other industry,  state, or federal protocols or  standards that the Secretary of  DHS determines to be  substantially equivalent.
None.
Would allow the Secretary to determine  that vulnerability assessments, security  plans, and emergency response plans  prepared under alternative security  programs meet the act’s requirements  and to permit submissions or  modifications to the assessments or  plans.
Would grant DHS right of entry;  would exempt facilities that are  subject to MTSA (port facilities) or  the Bioterrorism Act (community  water systems). Except with  respect to protection of  information, would not affect  requirements imposed under state  law.
Would grant EPA right of entry;  would authorize EPA to provide  grants for training of first responders  and employees at chemical facilities;  would not affect requirements  imposed under state law.
Would grant DHS right of entry; would  exempt facilities that are subject to MTSA  from certain area security requirements  but these facilities would otherwise  comply with the act’s requirements. Would  preserve the right of States to adopt  chemical security requirements that are  more stringent than the Federal standard,  as long as the State standard does not  conflict with the Federal standard.
S. 2486, introduced on March 30, 2006, would impose a general duty on  chemical facility owners and operators, in the same manner as the duty  under the Clean Air Act’s Section 112(r), to identify hazards that may  result from a criminal release, ensure the design, operation, and  maintenance of safe facilities by taking such actions as are necessary to  prevent criminal releases, and eliminate or significantly reduce the  consequences of any criminal release that does occur. S. 2486 also directs  DHS to work with EPA, as well as state and local agencies, to identify not  fewer than 3,000 high priority chemical facilities. These facilities would be  required to take adequate actions (including the design, operation, and  maintenance of safe facilities), to detect, prevent, or eliminate or  significantly reduce the consequences of criminal releases and to submit a  report to DHS that includes a vulnerability assessment; a hazards  assessment; a prevention, preparedness, and response plan; statements as  to how the response plan meets regulatory requirements and general duty  requirements; and a discussion of the consideration of the elements of  design, operation, and maintenance of safe facilities. “Design, operation,  and maintenance of safe facilities” is defined as practices of preventing or  reducing the possibility of a release through use of inherently safer  technologies, among other things. DHS would certify compliance and DHS  and EPA would establish a program to conduct inspections of facilities.  The bill also provides for civil penalties, administrative penalties, and  criminal penalties (including imprisonment for up to 2 years for first  violations and up to 4 years for subsequent violations), for owners or  operators of high priority facilities who fail to comply with an order.
Also in the 109th Congress, the conference committee for H.R. 2360,  making appropriations for DHS for fiscal year 2006, directed DHS to    submit a report to the Senate and House Committees on Appropriations by  February 10, 2006, describing (1) the resources needed to implement  mandatory security requirements for the chemical sector and to create a  system for auditing and ensuring compliance with the security standards  and (2) the security requirements and any reasons why the requirements  should differ from those already in place for chemical facilities that  operate in a port zone;   complete vulnerability assessments of the highest risk U.S. chemical  facilities by December 2006, giving preference to facilities that, if attacked,  pose the greatest threat to human life and the economy; and    complete a national security strategy for the chemical sector by February  10, 2006.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. It may be reproduced and distributed in its entirety without further  permission from GAO. However, because this work may contain copyrighted images or  other material, permission from the copyright holder may be necessary if you wish to  reproduce this material separately.