Critical Infrastructure Protection: Observations on DHS Efforts to Implement and Manage its Chemical Security Program
Published: 2014-05-14T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Facilities that produce, store, or use hazardous chemicals could be of interest to terrorists intent on using toxic chemicals to inflict mass casualties in the United States. As required by statute, DHS issued regulations establishing standards for the security of these facilities. DHS established the CFATS program to assess risk at facilities covered by the regulations and inspect them to ensure compliance.
This statement provides observations on DHS efforts related to the CFATS program. It is based on the results of previous GAO reports issued in July 2012 and April 2013 and a testimony issued in February 2014. In conducting the earlier work, GAO reviewed DHS reports and plans on the program and interviewed DHS officials.
section_title: What GAO Found
paragraphs: In managing its Chemical Facility Anti-Terrorism Standards (CFATS) program, the Department of Homeland Security (DHS) has a number of efforts underway to identify facilities that are covered by the program, assess risk and prioritize facilities, review and approve facility security plans, and inspect facilities to ensure compliance with security regulations.
Identifying facilities. DHS has begun to work with other agencies to identify facilities that should have reported their chemical holdings to CFATS, but may not have done so. DHS initially identified about 40,000 facilities by publishing a CFATS rule requiring that facilities with certain types and quantities of chemicals report certain information to DHS. However, a chemical explosion in West, Texas last year demonstrated the risk posed by chemicals covered by CFATS. Subsequent to this incident, the President issued Executive Order 13650 which was intended to improve chemical facility safety and security in coordination with owners and operators. Under the executive order, a federal working group is sharing information to identify additional facilities that are to be regulated under CFATS, among other things.
Assessing risk and prioritizing facilities. DHS has begun to enhance its ability to assess risks and prioritize facilities. DHS assessed the risks of facilities that reported their chemical holdings in order to determine which ones would be required to participate in the program and subsequently develop site security plans. GAO's April 2013 report found weaknesses in multiple aspects of the risk assessment and prioritization approach and made recommendations to review and improve this process. In February 2014, DHS officials told us they had begun to take action to revise the process for assessing risk and prioritizing facilities.
Reviewing security plans. DHS has also begun to take action to speed up its reviews of facility security plans. Per the CFATS regulation, DHS is to review security plans and visit the facilities to make sure their security measures meet the risk-based performance standards. GAO's April 2013 report found a 7- to 9-year backlog for these reviews and visits, and DHS has begun to take action to expedite these activities. As a separate matter, one of the performance standards—personnel surety, under which facilities are to perform background checks and ensure appropriate credentials for personnel and visitors as appropriate—is being developed. Of the facility plans DHS had reviewed as of February 2014, it conditionally approved these plans pending final development of the personal surety performance standard. According to DHS officials, it is unclear when the standard will be finalized.
Inspecting to verify compliance. In February 2014, DHS reported it had begun to perform inspections at facilities to ensure compliance with their site security plans. According to DHS, these inspections are to occur about 1 year after facility site security plan approval. Given the backlog in plan approvals, this process has started recently and GAO has not yet reviewed this aspect of the program.
section_title: What GAO Recommends
paragraphs: In a July 2012 report, GAO recommended that DHS measure its performance implementing actions to improve its management of CFATS. In an April 2013 report, GAO recommended that DHS enhance its risk assessment approach to incorporate all elements of risk, conduct a peer review, and gather feedback on its outreach to facilities. DHS concurred and has taken actions or has actions underway to address them.

section_title: Letter
paragraphs: I am pleased to be here today to discuss our work on the Department of  Homeland Security’s (DHS) efforts in implementing and managing the  Chemical Facility Anti-Terrorism Standards (CFATS) program. Facilities  that produce, store, or use hazardous chemicals could be of interest to  terrorists intent on using toxic chemicals to cause harm to surrounding  populations during terrorist attacks, and these chemicals could be stolen  and used as chemical weapons, such as improvised explosive devices, or  as the ingredients for making chemical weapons. The danger posed by  these chemicals became evident last year when ammonium nitrate—one  of the chemicals covered by the CFATS program—detonated during a fire  at a fertilizer storage and distribution facility in West, Texas. An  investigation by the U.S. Chemical Safety Board (CSB) showed that the  explosion killed at least 14 people and injured more than 200 others and  severely damaged or destroyed nearly 200 homes, 3 nearby schools, a  nursing home, and an apartment complex. According to CSB, the fire at  the facility detonated about 30 tons of ammonium nitrate. This event  serves as a tragic reminder of the extent to which chemicals covered by  the CFATS program can pose a risk to surrounding populations.
Pub. L. No. 109-295, § 550, 120 Stat. 1355, 1388 (2006). facilities to develop security plans, review these plans, and inspect the  facilities to ensure compliance with regulatory requirements. DHS’s  National Protection and Programs Directorate (NPPD) is responsible for  the CFATS program. Within NPPD, the Infrastructure Security  Compliance Division (ISCD), a division of the Office of Infrastructure  Protection (IP), manages the program.
On February 6, 2014 congressman Meehan and other members of the  House of Representatives’ Committee on Homeland Security, along with  one member of the House of Representatives’ Committee on Energy and  Commerce, introduced H.R. 4007, the Chemical Facility Anti-Terrorism  Standards Authorization and Accountability Act of 2014. Among other  things, H.R. 4007 contained provisions regarding multiple aspects of the  CFATS program, including risk assessment, security plan reviews, and  facility inspections. On April 30, 2014, the bill, as amended, was reported  out by the House Committee on Homeland Security. Related to H.R.  4007, on February 27, 2014, we testified on DHS efforts to implement and  manage the CFATS program at a legislative hearing before the  Subcommittee on Cybersecurity, Infrastructure Protection, and Security  Technologies, House Committee on Homeland Security.
The purpose of this statement is to provide our observations on the status  of DHS’s efforts related to the implementation and management of the  CFATS program. Specifically my testimony today summarizes our past  work on the CFATS program and provides our observations on the status  of DHS’s efforts in four key areas—identifying facilities to be covered by  CFATS, assessing risk and prioritizing covered facilities, reviewing facility  security plans, and inspecting facilities to verify compliance with CFATS  regulations. My statement is based on reports and a testimony we issued  from July 2012 through February 2014 on various aspects of the CFATS  program.regulations, as well as NPPD, IP, and ISCD policies and procedures for  administering the CFATS program and conducting its mission. We  interviewed senior ISCD officials along with NPPD and IP officials to  obtain their views on the program and how ISCD assesses risk. We also  reviewed ISCD documents and data on tiered facilities and the approach  used to determine a facility’s risk and assessed ISCD’s process for  reviewing security plans. Further details on the scope and methodology  for the previously issued reports and testimony statement are available  within each of the published products.
To conduct our prior work, we reviewed applicable laws and  We conducted the work on which this statement is based in accordance  with generally accepted government auditing standards. Those standards  require that we plan and perform the audit to obtain sufficient, appropriate  evidence to provide a reasonable basis for our findings and conclusions  based on our audit objectives. We believe the evidence obtained provides  a reasonable basis for our findings and conclusions based on our audit  objectives.
subsections: section_title: Observations on DHS Efforts to Identify Facilities, Assess Risk, Review Security Plans, and Verify Compliance
subsections: section_title: Identifying Facilities Covered by CFATS
paragraphs: DHS has begun to take action to work with other agencies to identify  facilities that are required to report their chemical holdings to DHS but  may not have done so.
The first step of the CFATS process is focused on identifying facilities that  might be required to participate in the program. The CFATS rule was  published in April 2007, and appendix A to the rule, published in  November 2007, listed 322 chemicals of interest and the screening  threshold quantities for each. As a result of the CFATS rule, about  40,000 chemical facilities reported their chemical holdings and their  quantities to DHS’s ISCD.
In August 2013, we testified about the ammonium nitrate explosion at the  chemical facility in West, Texas, in the context of our past CFATS work.  Among other things, the hearing focused on whether the West, Texas,  facility should have reported its holdings to ISCD given the amount of  ammonium nitrate at the facility. During this hearing, the Director of the  CFATS program remarked that throughout the existence of CFATS, DHS  had undertaken and continued to support outreach and industry  engagement to ensure that facilities comply with their reporting  requirements. However, the Director stated that the CFATS regulated  community is large and always changing and DHS relies on facilities to  meet their reporting obligations under CFATS. At the same hearing, a  representative of the American Chemistry Council testified that the West,  Texas, facility could be considered an “outlier” chemical facility, that is, a  facility that stores or distributes chemical-related products, but is not part  of the established chemical industry. Preliminary findings of the CSB  investigation of the West, Texas, incident showed that although certain  federal agencies that regulate chemical facilities may have interacted with  the facility, the ammonium nitrate at the West, Texas, facility was not  covered by these programs. For example, according to the findings, the  Environmental Protection Agency’s (EPA) Risk Management Program,  which deals with the accidental release of hazardous substances, covers  the accidental release of ammonia, but not ammonium nitrate. As a result, the facility’s consequence analysis considered only the possibility  of an ammonia leak and not an explosion of ammonium nitrate.
On August 1, 2013, the same day as the hearing, the President issued  Executive Order 13650–Improving Chemical Facility Safety and Security,  which was intended to improve chemical facility safety and security in  coordination with owners and operators. The executive order  established a Chemical Facility Safety and Security Working Group,  composed of representatives from DHS; EPA; and the Departments of  Justice, Agriculture, Labor, and Transportation, and directed the working  group to identify ways to improve coordination with state and local  partners; enhance federal agency coordination and information sharing;  modernize policies, regulations and standards; and work with  stakeholders to identify best practices. In February 2014, DHS officials  told us that the working group has taken actions in the areas described in  the executive order. For example, according to DHS officials, the working  group has held listening sessions and webinars to increase stakeholder  input, explored ways to share CFATS data with state and local partners to  increase coordination, and launched a pilot program in New York and  New Jersey aimed at increasing federal coordination and information  sharing. DHS officials also said that the working group is exploring ways  to better share information so that federal and state agencies can identify  non-compliant chemical facilities and identify options to improve chemical  facility risk management. This would include considering options to  improve the safe and secure storage, handling, and sale of ammonium  nitrate.
section_title: Assessing Risk and Prioritizing Facilities
paragraphs: DHS has also begun to take actions to enhance its ability to assess risk  and prioritize facilities covered by the program.
For the second step of the CFATS process, facilities that possess any of  the 322 chemicals of interest at levels at or above the screening threshold  quantity must first submit data to ISCD via an online tool called a Top- Screen.an assessment as to whether facilities are covered under the program. If  DHS determines that they are covered by CFATS, facilities are to then  submit data via another online tool, called a security vulnerability  assessment, so that ISCD can further assess their risk and prioritize the   ISCD uses the data submitted in facilities’ Top Screens to make  covered facilities. ISCD uses a risk assessment approach to develop  risk scores to assign chemical facilities to one of four final tiers. Facilities  placed in one of these tiers (tier 1, 2, 3, or 4) are considered to be high  risk, with tier 1 facilities considered to be the highest risk. The risk score  is intended to be derived from estimates of consequence (the adverse  effects of a successful attack), threat (the likelihood of an attack), and  vulnerability (the likelihood of a successful attack, given an attempt).  ISCD’s risk assessment approach is composed of three models, each  based on a particular security issue: (1) release, (2) theft or diversion, and  (3) sabotage, depending on the type of risk associated with the 322  chemicals. Once ISCD estimates a risk score based on these models, it  assigns the facility to a final tier.
Our prior work showed that the CFATS program was using an incomplete  risk assessment approach to assign chemical facilities to a final tier.  Specifically, in April 2013, we reported that the approach ISCD used to  assess risk and make decisions to place facilities in final tiers did not  consider all of the elements of consequence, threat, and vulnerability  associated with a terrorist attack involving certain chemicals. For  example, the risk assessment approach was based primarily on  consequences arising from human casualties, but did not consider  economic criticality consequences, as called for by the 2009 National  Infrastructure Protection Plan (NIPP) and the CFATS regulation. In  April 2013, we reported that ISCD officials told us that, at the inception of  the CFATS program, they did not have the capability to collect or process  all of the economic data needed to calculate the associated risks and they  were not positioned to gather all of the data needed. They said that they  collected basic economic data as part of the initial screening process;  however, they would need to modify the current tool to collect more  sufficient data. We also found that the risk assessment approach did not  consider threat for approximately 90 percent of tiered facilities. Moreover,  for the facilities that were tiered using threat considerations, ISCD was  using 5-year-old data. We also found that ISCD’s risk assessment  approach was not consistent with the NIPP because it did not consider  vulnerability when developing risk scores. When assessing facility risk,  ISCD’s risk assessment approach treated every facility as equally  vulnerable to a terrorist attack regardless of location and on-site security.  As a result, in April 2013 we recommended that ISCD enhance its risk  assessment approach to incorporate all elements of risk and conduct a  peer review after doing so.
ISCD agreed with our recommendations, and in February 2014, ISCD  officials told us that they were taking steps to address them and  recommendations of a recently released Homeland Security Studies and  Analysis Institute (HSSAI) report that examined the CFATS risk  assessment model. As with the findings in our report, HSSAI found,  among other things, that the CFATS risk assessment model  inconsistently considers risks across different scenarios and that the  model does not adequately treat facility vulnerability. Overall, HSSAI  recommended that ISCD revise the current risk-tiering model and create  a standing advisory committee—with membership drawn from  government, expert communities, and stakeholder groups—to advise  DHS on significant changes to the methodology.
In February 2014, senior ISCD officials told us that they have developed  an implementation plan that outlines how they plan to modify the risk  assessment approach to better include all elements of risk while  incorporating our findings and recommendations and those of HSSAI.  Moreover, these officials stated that they have completed significant work  with Sandia National Laboratory with the goal of including economic  consequences into their risk tiering approach. They said that the final  results of this effort to include economic consequences will be available in  the summer of 2014. With regard to threat and vulnerability, ISCD officials  said that they have been working with multiple DHS components and  agencies, including the Transportation Security Administration and the  Coast Guard, to see how they consider threat and vulnerability in their  risk assessment models. ISCD officials said that they anticipate that the  changes to the risk tiering approach should be completed within the next  12 to 18 months. We plan to verify this information as part of our  recommendation follow-up process.
section_title: Reviewing of Facilities’ Security Plans
paragraphs: DHS has begun to take action to lessen the time it takes to review site  security plans which could help DHS reduce the backlog of plans awaiting  review.
For the third step of the CFATS process, ISCD is to review facility security  plans and their procedures for securing these facilities. Under the CFATS  rule, once a facility is assigned a final tier, it is to submit a site security  plan or participate in an alternative security program in lieu of a site  security plan. The security plan is to describe security measures to be  taken and how such measures are to address applicable risk-based  performance standards. After ISCD receives the site security plan, the  plan is reviewed using teams of ISCD employees (i.e., physical, cyber,  chemical, and policy specialists), contractors, and ISCD inspectors. If  ISCD finds that the requirements are satisfied, ISCD issues a letter of  authorization to the facility. After ISCD issues a letter of authorization to  the facility, ISCD is to then inspect the facility to determine if the security  measures implemented at the site comply with the facility’s authorized  plan. If ISCD determines that the site security plan is in compliance with  the CFATS regulation, ISCD approves the site security plan, and issues a  letter of approval to the facility, and the facility is to implement the  approved site security plan.
In April 2013, we reported that it could take another 7 to 9 years before  ISCD would be able to complete reviews of the approximately 3,120 plans  in its queue at that time. As a result, we estimated that the CFATS  regulatory regime, including compliance inspections (discussed in the  next section), would likely not be implemented for 8 to 10 years. We also  noted in April 2013 that ISCD had revised its process for reviewing  facilities’ site security plans. ISCD officials stated that they viewed ISCD’s  revised process to be an improvement because, among other things,  teams of experts reviewed parts of the plans simultaneously rather than  sequentially, as had occurred in the past. In April 2013, ISCD officials  said that they were exploring ways to expedite the process, such as  streamlining inspection requirements.
In February 2014, ISCD officials told us that they are taking a number of  actions intended to lessen the time it takes to complete reviews of  remaining plans including the following: providing updated internal guidance to inspectors and ISCD updating the internal case management system; providing updated external guidance to facilities to help them better  prepare their site security plans;  conducting inspections using one or two inspectors at a time over the  course of 1 day, rather than multiple inspectors over the course of  several days;  conducting pre-inspection calls to the facility to help resolve technical  issues beforehand;  creating and leveraging the use of corporate inspection documents  (i.e., documents for companies that have over seven regulated  facilities in the CFATS program);  supporting the use of alternative security programs to help clear the  backlog of security plans because, according to DHS officials,  alternative security plans are easier for some facilities to prepare and  use; and  taking steps to streamline and revise some of the on-line data  collection tools such as the site security plan to make the process  faster.
It is too soon to tell whether DHS’s actions will significantly reduce the  amount of time needed to resolve the backlog of site security plans  because these actions have not yet been fully implemented.
In April 2013, we also reported that DHS had not finalized the personnel  surety aspect of the CFATS program. The CFATS rule includes a risk- based performance standard for personnel surety, which is intended to  provide assurance that facility employees and other individuals with  access to the facility are properly vetted and cleared for access to the  facility. In implementing this provision, we reported that DHS intended to  (1) require facilities to perform background checks on and ensure  appropriate credentials for facility personnel and, as appropriate, visitors  with unescorted access to restricted areas or critical assets, and (2)  check for terrorist ties by comparing certain employee information with the  federal government’s consolidated terrorist watch list. However, as of  February 2014, DHS had not finalized its information collection request  that defines how the personnel surety aspect of the performance  standards will be implemented. Thus, DHS is currently approving facility  security plans conditionally whereby plans are not to be finally approved  until the personnel surety aspect of the program is finalized. According to  ISCD officials, once the personnel surety performance standard is  finalized, they plan to reexamine each conditionally approved plan. They  would then make final approval as long as ISCD had assurance that the  facility was in compliance with the personnel surety performance  standard. As an interim step, in February 2014, DHS published a notice  about its Information Collection Request (ICR) for personnel surety to  gather information and comments prior to submitting the ICR to the Office   According  of Management and Budget (OMB) for review and clearance.to ISCD officials, it is unclear when the personnel surety aspect of the  CFATS program will be finalized.
During a March 2013 hearing on the CFATS program, industry officials  discussed using DHS’s Transportation Worker Identification Credential  (TWIC) as one approach for implementing the personnel surety program.  The TWIC, which is also discussed in DHS’s ICR, is a biometric  credential issued by DHS for maritime workers who require unescorted  access to secure areas of facilities and vessels regulated under the  Maritime Transportation Security Act of 2002 (MTSA). In discussing  TWIC in the context of CFATS during the August 2013 hearing, officials  representing some segments of the chemical industry stated that they  believe that using TWIC would lessen the reporting burden and prevent  facilities from having to submit additional personnel information to DHS  while maintaining the integrity of the program. In May 2011, and May  2013, we reported that the TWIC program has some shortfalls—including  challenges in development, testing, and implementation—that may limit  its usefulness with regard to the CFATS program. We recommended  that DHS take steps to resolve these issues, including completing a  security assessment that includes addressing internal controls  weaknesses, among other things. The explanatory statement  accompanying the Consolidated Appropriations Act, 2014, directed DHS  to complete the recommended security assessment.February 2014, DHS had not yet done the assessment, and although   However, as of  DHS had taken some steps to conduct an internal control review, it had  not corrected all the control deficiencies identified in our report.
section_title: Inspecting to Verify Compliance with Facility Plans
paragraphs: DHS reports that it has begun to perform compliance inspections at  regulated facilities. The fourth step in the CFATS process is compliance  inspections by which ISCD determines if facilities are employing the  measures described in their site security plans. During the August 1,  2013, hearing on the West, Texas, explosion, the Director of the CFATS  program stated that ISCD planned to begin conducting compliance  inspections in September 2013 for facilities with approved site security  plans. The Director further noted that the inspections would generally be  conducted approximately 1 year after plan approval. According to ISCD,  as of February 24, 2014, ISCD had conducted 12 compliance inspections.  ISCD officials stated that they have considered using third-party non- governmental inspectors to conduct inspections but thus far do not have  any plans to do so.
In closing, we anticipate providing oversight over the issues outlined  above and look forward to helping this and other committees of Congress  continue to oversee the CFATS program and DHS’s progress in  implementing this program. Currently, the explanatory statement  accompanying the Consolidated and Further Continuing Appropriations  Act, 2013, directs GAO to continue its ongoing effort to examine the  extent to which DHS has made progress and encountered challenges in  developing CFATS. Additionally, once the CFATS program begins  performing and completing a sufficient number of compliance inspections,  we are mandated review those inspections along with various aspects of  them.
Chairman Carper, Ranking Member Coburn, and members of the  Committee, this completes my prepared statement. I would be happy to  respond to any questions you may have at this time.
section_title: GAO Contact and Staff Acknowledgments
paragraphs: For information about this statement please contact Stephen L. Caldwell,  at (202) 512-9610 or caldwellS@gao.gov. Contact points for our Offices  of Congressional Relations and Public Affairs may be found on the last  page of this statement. Other individuals making key contributions to this  and our prior work included John F. Mortin, Assistant Director; Jose  Cardenas, Analyst-in-Charge; Chuck Bausell; Michele Fejfar; Jeff Jensen;  Tracey King; Marvin McGill; Jessica Orr; Hugh Paquette, and Ellen Wolfe.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.