Critical Infrastructure Protection: Observations on DHS Efforts to Identify, Prioritize, Assess, and Inspect Chemical Facilities
Published: 2014-02-27T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Facilities that produce, store, or use hazardous chemicals could be of interest to terrorists intent on using toxic chemicals to inflict mass casualties in the United States. As required by statute, DHS issued regulations establishing standards for the security of these facilities. DHS established the CFATS program to assess risk at facilities covered by the regulations and inspect them to ensure compliance. In February 2014, legislation was introduced related to several aspects of the program.
This statement provides observations on DHS efforts related to the CFATS program. It is based on the results of previous GAO reports in July 2012 and April 2013, with selected updates conducted in February 2014. In conducting the earlier work, GAO reviewed DHS reports and plans on the program and interviewed DHS officials. In addition, GAO interviewed DHS officials to update information.
section_title: What GAO Found
paragraphs: In managing its Chemical Facility Anti-Terrorism Standards (CFATS) program, the Department of Homeland Security (DHS) has a number of efforts underway to identify facilities that are covered by the program, assess risk and prioritize facilities, review and approve facility security plans, and inspect facilities to ensure compliance with security regulations.
Identifying facilities. DHS has begun to work with other agencies to identify facilities that should have reported their chemical holdings to CFATS, but may not have done so. DHS initially identified about 40,000 facilities by publishing a CFATS rule requiring that facilities with certain types of chemicals report the types and quantities of these chemicals. However, a chemical explosion in West, Texas last year demonstrated the risk posed by chemicals covered by CFATS. Subsequent to this incident, the President issued Executive Order 13650 which was intended to improve chemical facility safety and security in coordination with owners and operators. Under the executive order, a federal working group is sharing information to identify additional facilities that are to be regulated under CFATS, among other things.
Assessing risk and prioritizing facilities. DHS has begun to enhance its ability to assess risks and prioritize facilities. DHS assessed the risks of facilities that reported their chemical holdings in order to determine which ones would be required to participate in the program and subsequently develop site security plans. GAO's April 2013 report found weaknesses in multiple aspects of the risk assessment and prioritization approach and made recommendations to review and improve this process. In February 2014, DHS officials told us they had begun to take action to revise the process for assessing risk and prioritizing facilities.
Reviewing security plans . DHS has also begun to take action to speed up its reviews of facility security plans. Per the CFATS regulation, DHS was to review security plans and visit the facilities to make sure their security measures met the risk-based performance standards. GAO's April 2013 report found a 7- to 9-year backlog for these reviews and visits, and DHS has begun to take action to expedite these activities. As a separate matter, one of the performance standards—personnel surety, under which facilities are to perform background checks and ensure appropriate credentials for personnel and visitors as appropriate—is being developed. As of February 2014, DHS has reviewed and conditionally approved facility plans pending final development of the personal surety performance standard.
Inspecting to verify compliance . In February 2014, DHS reported it had begun to perform inspections at facilities to ensure compliance with their site security plans. According to DHS, these inspections are to occur about 1 year after facility site security plan approval. Given the backlog in plan approvals, this process has started recently and GAO has not yet reviewed this aspect of the program.
section_title: What GAO Recommends
paragraphs: In a July 2012 report, GAO recommended that DHS measure its performance implementing actions to improve its management of CFATS. In an April 2013 report, GAO recommended that DHS enhance its risk assessment approach to incorporate all elements of risk, conduct a peer review, and gather feedback on its outreach to facilities. DHS concurred with these recommendations and has taken actions or has actions underway to address them.
GAO provided a draft of the updated information to DHS for review, and DHS confirmed its accuracy.

section_title: Letter
paragraphs: I am pleased to be here today to discuss our work on the Department of  Homeland Security’s (DHS) efforts in implementing and managing the  Chemical Facility Anti-Terrorism Standards (CFATS) program. Facilities  that produce, store, or use hazardous chemicals could be of interest to  terrorists intent on using toxic chemicals to cause harm to surrounding  populations during terrorist attacks, and these chemicals could be stolen  and used as chemical weapons, such as improvised explosive devices, or  as the ingredients for making chemical weapons. The danger posed by  these chemicals became evident last year when ammonium nitrate—one  of the chemicals covered by the CFATS program—detonated during a fire  at a fertilizer storage and distribution facility in West, Texas. An  investigation by the U.S. Chemical Safety Board (CSB) showed that the  explosion killed at least 14 people and injured more than 200 others and  severely damaged or destroyed nearly 200 homes, 3 nearby schools, a  nursing home, and an apartment complex. According to CSB, the fire at  the facility detonated about 30 tons of ammonium nitrate. This event  serves as a tragic reminder of the extent to which chemicals covered by  the CFATS program can pose a risk to surrounding populations.
Pub. L. No. 109-295, § 550, 120 Stat. 1355, 1388 (2006). facilities considered to be high-risk in one of four risk-based tiers, require  high-risk facilities to develop security plans, review these plans, and  inspect the facilities to ensure compliance with regulatory requirements.  DHS’s National Protection and Programs Directorate (NPPD) is  responsible for the CFATS program. Within NPPD, the Infrastructure  Security Compliance Division (ISCD), a division of the Office of  Infrastructure Protection (IP), manages the program.
On February 6, 2014, congressman Meehan and other Members of the  House of Representatives’ Committee on Homeland Security, along with  one member of the House of Representatives’ Committee on Energy and  Commerce, introduced H.R. 4007, the Chemical Facility Anti-Terrorism   This  Standards Program Authorization and Accountability Act of 2014.bill would authorize the CFATS program for 2 years and would take effect  30 days after enactment. This bill includes provisions regarding multiple  aspects of the CFATS program, including risk assessment, security plan  reviews, and facility inspections. Among other things, H.R. 4007 would  require DHS to consult with the heads of other federal agencies,  states and political subdivisions and business associations to identify  chemical facilities of interest; direct DHS to develop a risk assessment approach that includes all  elements of risk, including threat data based on available intelligence,  the vulnerability of the facility to terrorist attack, and consequence  measurements including potential economic consequences;  reaffirm the risk-based performance standard approach to facility  security plans and the use of Alternative Security Programs allow chemical facilities to utilize any federal screening program that  periodically vets individuals against the terrorist screening database to  satisfy the requirements of a personnel surety performance standard; authorize the use of non-department or non-government entities, with  the Secretary’s approval, for audits and inspections; and  require us to submit a semiannual report to Congress containing our  assessment of the implementation of the bill.
My testimony today summarizes our past work on the CFATS program  and provides our observations on the status of DHS’s efforts in four key  areas—identifying facilities to be covered by CFATS, assessing risk and  prioritizing covered facilities, reviewing facility security plans, and  inspecting facilities to verify compliance with CFATS regulations. My  statement is based on reports and testimonies we issued from July 2012  through August 2013 on various aspects of the CFATS program in  addition to work we conducted in February 2014 to update the status of  DHS actions related to these four areas. To conduct our prior work, we  reviewed applicable laws and regulations, as well as NPPD, IP, and ISCD  policies and procedures for administering the CFATS program and  conducting its mission. We interviewed senior ISCD officials along with  NPPD and IP officials to obtain their views on the program and how ISCD  assesses risk. We also reviewed ISCD documents and data on tiered  facilities and the approach used to determine a facility’s risk and  assessed ISCD’s process for reviewing security plans. Further details on  the scope and methodology for the previously issued reports are available  within each of the published products. To update our work, we met with  senior ISCD officials and discussed status updates on the four areas  (identifying facilities, assessing risk and prioritizating facilities, reviewing  security plans, and inspecting facilities). Where possible, we also  reviewed available documentation pertinent to each of the key areas. We  provided a copy of new information in this statement to DHS for review.  DHS confirmed the accuracy of this information.
We conducted the work on which this statement is based in accordance  with generally accepted government auditing standards. Those standards  require that we plan and perform the audit to obtain sufficient, appropriate  evidence to provide a reasonable basis for our findings and conclusions  based on our audit objectives. We believe the evidence obtained provides  a reasonable basis for our findings and conclusions based on our audit  objectives.
subsections: section_title: Observations on DHS Efforts to Identify Facilities, Assess Risk, Review Security Plans, and Verify Compliance
subsections: section_title: Identifying Facilities Covered by CFATS
paragraphs: DHS has begun to take action to work with other agencies to identify  facilities that are required to report their chemical holdings to DHS but  may not have done so.
The first step of the CFATS process is focused on identifying facilities that  might be required to participate in the program. The CFATS rule was  published in April 2007, and appendix A to the rule, published in  November 2007, listed 322 chemicals of interest and the screening  threshold quantities for each. As a result of the CFATS rule, about  40,000 chemical facilities reported their chemical holdings and their  quantities to DHS’s ISCD.
In August 2013, we testified about the ammonium nitrate explosion at the  chemical facility in West, Texas, in the context of our past CFATS work.  Among other things, the hearing focused on whether the West, Texas,  facility should have reported its holdings to ISCD given the amount of  ammonium nitrate at the facility. During this hearing, the Director of the  CFATS program remarked that throughout the existence of CFATS, DHS  had undertaken and continued to support outreach and industry  engagement to ensure that facilities comply with their reporting  requirements. However, the Director stated that the CFATS regulated  community is large and always changing and DHS relies on facilities to  meet their reporting obligations under CFATS. At the same hearing, a  representative of the American Chemistry Council testified that the West,  Texas, facility could be considered an “outlier” chemical facility, that is, a  facility that stores or distributes chemical-related products, but is not part  of the established chemical industry. Preliminary findings of the CSB  investigation of the West, Texas, incident showed that although certain  federal agencies that regulate chemical facilities may have interacted with  the facility, the ammonium nitrate at the West, Texas, facility was not  covered by these programs. For example, according to the findings, the  Environmental Protection Agency’s (EPA) Risk Management Program,  which deals with the accidental release of hazardous substances, covers  the accidental release of ammonia, but not ammonium nitrate. As a  result, the facility’s consequence analysis considered only the possibility  of an ammonia leak and not an explosion of ammonium nitrate.
On August 1, 2013, the same day as the hearing, the President issued  Executive Order 13650–Improving Chemical Facility Safety and Security,  which was intended to improve chemical facility safety and security in  coordination with owners and operators.established a Chemical Facility Safety and Security Working Group,  composed of representatives from DHS; EPA; and the Departments of  Justice, Agriculture, Labor, and Transportation, and directed the working  group to identify ways to improve coordination with state and local  partners; enhance federal agency coordination and information sharing;  modernize policies, regulations and standards; and work with  stakeholders to identify best practices. In February 2014, DHS officials  told us that the working group has taken actions in the areas described in  the executive order. For example, according to DHS officials, the working  group has held listening sessions and webinars to increase stakeholder  input, explored ways to share CFATS data with state and local partners to  increase coordination, and launched a pilot program in New York and  New Jersey aimed at increasing federal coordination and information  sharing. DHS officials also said that the working group is exploring ways   The executive order  to better share information so that federal and state agencies can identify  non-compliant chemical facilities and identify options to improve chemical  facility risk management. This would include considering options to  improve the safe and secure storage, handling, and sale of ammonium  nitrate.
section_title: Assessing Risk and Prioritizing Facilities
paragraphs: DHS has also begun to take actions to enhance its ability to assess risk  and prioritize facilities covered by the program.
For the second step of the CFATS process, facilities that possess any of  the 322 chemicals of interest at levels at or above the screening threshold  quantity must first submit data to ISCD via an online tool called a Top- Screen. ISCD uses the data submitted in facilities’ Top Screens to make  an assessment as to whether facilities are covered under the program. If  DHS determines that they are covered by CFATS, facilities are to then  submit data via another online tool, called a security vulnerability  assessment, so that ISCD can further assess their risk and prioritize the  covered facilities. ISCD uses a risk assessment approach to develop  risk scores to assign chemical facilities to one of four final tiers. Facilities  placed in one of these tiers (tier 1, 2, 3, or 4) are considered to be high  risk, with tier 1 facilities considered to be the highest risk. The risk score  is intended to be derived from estimates of consequence (the adverse  effects of a successful attack), threat (the likelihood of an attack), and  vulnerability (the likelihood of a successful attack, given an attempt).  ISCD’s risk assessment approach is composed of three models, each  based on a particular security issue: (1) release, (2) theft or diversion, and  (3) sabotage, depending on the type of risk associated with the 322  chemicals. Once ISCD estimates a risk score based on these models, it  assigns the facility to a final tier.
Our prior work showed that the CFATS program was using an incomplete  risk assessment approach to assign chemical facilities to a final tier.  Specifically, in April 2013, we reported that the approach ISCD used to  assess risk and make decisions to place facilities in final tiers did not  consider all of the elements of consequence, threat, and vulnerability  associated with a terrorist attack involving certain chemicals. For  example, the risk assessment approach was based primarily on  consequences arising from human casualties, but did not consider  economic criticality consequences, as called for by the 2009 National  Infrastructure Protection Plan (NIPP) and the CFATS regulation. In  April 2013, we reported that ISCD officials told us that, at the inception of  the CFATS program, they did not have the capability to collect or process  all of the economic data needed to calculate the associated risks and they  were not positioned to gather all of the data needed. They said that they  collected basic economic data as part of the initial screening process;  however, they would need to modify the current tool to collect more  sufficient data. We also found that the risk assessment approach did not  consider threat for approximately 90 percent of tiered facilities. Moreover,  for the facilities that were tiered using threat considerations, ISCD was  using 5-year-old data. We also found that ISCD’s risk assessment  approach was not consistent with the NIPP because it did not consider  vulnerability when developing risk scores. When assessing facility risk,  ISCD’s risk assessment approach treated every facility as equally  vulnerable to a terrorist attack regardless of location and on-site security.  As a result, in April 2013 we recommended that ISCD enhance its risk  assessment approach to incorporate all elements of risk and conduct a  peer review after doing so.
ISCD agreed with our recommendations, and in February 2014, ISCD  officials told us that they were taking steps to address them and  recommendations of a recently released Homeland Security Studies and  Analysis Institute (HSSAI) report that examined the CFATS risk  assessment model.among other things, that the CFATS risk assessment model  inconsistently considers risks across different scenarios and that the  model does not adequately treat facility vulnerability. Overall, HSSAI  recommended that ISCD revise the current risk-tiering model and create  a standing advisory committee—with membership drawn from  government, expert communities, and stakeholder groups—to advise  DHS on significant changes to the methodology.
As with the findings in our report, HSSAI found,  In February 2014, senior ISCD officials told us that they have developed  an implementation plan that outlines how they plan to modify the risk  assessment approach to better include all elements of risk while  incorporating our findings and recommendations and those of HSSAI.  Moreover, these officials stated that they have completed significant work  with Sandia National Laboratory with the goal of including economic  consequences into their risk tiering approach. They said that the final  results of this effort to include economic consequences will be available in  the summer of 2014. With regard to threat and vulnerability, ISCD officials  said that they have been working with multiple DHS components and  agencies, including the Transportation Security Administration and the  Coast Guard, to see how they consider threat and vulnerability in their  risk assessment models. ISCD officials said that they anticipate that the  changes to the risk tiering approach should be completed within the next  12 to 18 months. We plan to verify this information as part of our  recommendation follow-up process.
section_title: Reviewing of Facilities’ Security Plans
paragraphs: DHS has begun to take action to lessen the time it takes to review site  security plans which could help DHS reduce the backlog of plans awaiting  review.
For the third step of the CFATS process, ISCD is to review facility security  plans and their procedures for securing these facilities. Under the CFATS  rule, once a facility is assigned a final tier, it is to submit a site security  plan or participate in an alternative security program in lieu of a site  security plan. The security plan is to describe security measures to be  taken and how such measures are to address applicable risk-based  performance standards. After ISCD receives the site security plan, the  plan is reviewed using teams of ISCD employees (i.e., physical, cyber,  chemical, and policy specialists), contractors, and ISCD inspectors. If  ISCD finds that the requirements are satisfied, ISCD issues a letter of  authorization to the facility. After ISCD issues a letter of authorization to  the facility, ISCD is to then inspect the facility to determine if the security  measures implemented at the site comply with the facility’s authorized  plan. If ISCD determines that the site security plan is in compliance with  the CFATS regulation, ISCD approves the site security plan, and issues a  letter of approval to the facility, and the facility is to implement the  approved site security plan.
In April 2013, we reported that it could take another 7 to 9 years before  ISCD would be able to complete reviews of the approximately 3,120 plans  in its queue at that time. As a result, we estimated that the CFATS  regulatory regime, including compliance inspections (discussed in the  next section), would likely not be implemented for 8 to 10 years. We also  noted in April 2013 that ISCD had revised its process for reviewing  facilities’ site security plans. ISCD officials stated that they viewed ISCD’s  revised process to be an improvement because, among other things,  teams of experts reviewed parts of the plans simultaneously rather than  sequentially, as had occurred in the past. In April 2013, ISCD officials  said that they were exploring ways to expedite the process, such as  streamlining inspection requirements.
In February 2014, ISCD officials told us that they are taking a number of  actions intended to lessen the time it takes to complete reviews of  remaining plans including the following: providing updated internal guidance to inspectors and ISCD updating the internal case management system; providing updated external guidance to facilities to help them better  prepare their site security plans;  conducting inspections using one or two inspectors at a time over the  course of 1 day, rather than multiple inspectors over the course of  several days;  conducting pre-inspection calls to the facility to help resolve technical  issues beforehand;  creating and leveraging the use of corporate inspection documents  (i.e., documents for companies that have over seven regulated  facilities in the CFATS program);  supporting the use of alternative security programs to help clear the  backlog of security plans because, according to DHS officials,  alternative security plans are easier for some facilities to prepare and  use; and  taking steps to streamline and revise some of the on-line data  collection tools such as the site security plan to make the process  faster.
It is too soon to tell whether DHS’s actions will significantly reduce the  amount of time needed to resolve the backlog of site security plans  because these actions have not yet been fully implemented.
In April 2013, we also reported that DHS had not finalized the personnel  surety aspect of the CFATS program. The CFATS rule includes a risk- based performance standard for personnel surety, which is intended to  provide assurance that facility employees and other individuals with  access to the facility are properly vetted and cleared for access to the  facility. In implementing this provision, we reported that DHS intended to  (1) require facilities to perform background checks on and ensure  appropriate credentials for facility personnel and, as appropriate, visitors  with unescorted access to restricted areas or critical assets, and (2)  check for terrorist ties by comparing certain employee information with its  terrorist screening database. However, as of February 2014, DHS had not  finalized its information collection request that defines how the personal  surety aspect of the performance standards will be implemented. Thus,  DHS is currently approving facility security plans conditionally whereby  plans are not to be finally approved until the personnel surety aspect of  the program is finalized. According to ISCD officials, once the personal  surety performance standard is finalized, they plan to reexamine each  conditionally approved plan. They would then make final approval as long  as ISCD had assurance that the facility was in compliance with the  personnel surety performance standard. As an interim step, in February  2014, DHS published a notice about its Information Collection Request  (ICR) for personnel surety to gather information and comments prior to  submitting the ICR to the Office of Management and Budget (OMB) for  review and clearance. According to ISCD officials, it is unclear when the  personnel surety aspect of the CFATS program will be finalized.
A biometric access control system consists of technology that determines an individual’s  identity by detecting and matching unique physical or behavioral characteristics, such as  fingerprint or voice patterns, as a means of verifying personal identity. its usefulness with regard to the CFATS program. We recommended  that DHS take steps to resolve these issues, including completing a  security assessment that includes addressing internal controls  weaknesses, among other things. The explanatory statement  accompanying the Consolidated Appropriations Act, 2014, directed DHS  to complete the recommended security assessment.February 2014, DHS had not yet done the assessment, and although  DHS had taken some steps to conduct an internal control review, it had  not corrected all the control deficiencies identified in our report.
section_title: Inspecting to Verify Compliance with Facility Plans
paragraphs: DHS reports that it has begun to perform compliance inspections at  regulated facilities. The fourth step in the CFATS process is compliance  inspections by which ISCD determines if facilities are employing the  measures described in their site security plans. During the August 1,  2013, hearing on the West, Texas, explosion, the Director of the CFATS  program stated that ISCD planned to begin conducting compliance  inspections in September 2013 for facilities with approved site security  plans. The Director further noted that the inspections would generally be  conducted approximately 1 year after plan approval. According to ISCD,  as of February 24, 2014, ISCD had conducted 12 compliance inspections.  ISCD officials stated that they have considered using third-party non- governmental inspectors to conduct inspections but thus far do not have  any plans to do so.
In closing, we anticipate providing oversight over the issues outlined  above and look forward to helping this and other committees of Congress  continue to oversee the CFATS program and DHS’s progress in  implementing this program. Currently, the explanatory statement  accompanying the Consolidated and Further Continuing Appropriations  Act, 2013, requires GAO to continue its ongoing effort to examine the  extent to which DHS has made progress and encountered challenges in  developing CFATS. Additionally, once the CFATS program begins  performing and completing a sufficient number of compliance inspections,  we are mandated review those inspections along with various aspects of  them. Moreover, Ranking Member Thompson of the Committee on  Homeland Security has requested that we examine among other things,  DHS efforts to assess information on facilities that submit data, but that  DHS ultimately decides are not to be covered by the program.
Chairman Meehan, Ranking Member Clarke, and members of the  subcommittee, this completes my prepared statement. I would be happy  to respond to any questions you may have at this time.
section_title: GAO Contact and Staff Acknowledgments
paragraphs: For information about this statement please contact Stephen L. Caldwell,  at (202) 512-9610 or CaldwellS@gao.gov. Contact points for our Offices  of Congressional Relations and Public Affairs may be found on the last  page of this statement. Other individuals making key contributions to this  and our prior work included John F. Mortin, Assistant Director; Jose  Cardenas, Analyst-in-Charge; Chuck Bausell; Michele Fejfar; Jeff Jensen;  Tracey King; Marvin McGill; Jessica Orr; Hugh Paquette, and Ellen Wolfe.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.