Biosafety Laboratories: Perimeter Security Assessment of the Nation's Five BSL-4 Laboratories
Published: 2008-09-17T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Biosafety labs under the U.S. Bioterrorism Act are primarily regulated and must be registered with either the Centers for Disease Control and Prevention (CDC) or the U.S. Department of Agriculture (USDA) under the Select Agent Regulations. Currently, all operational biosafety level (BSL) 4 labs are registered with the CDC and thus are regulated by the CDC, not USDA. BSL-4 labs handle the world's most dangerous agents and diseases. In fact, of the four BSL designations, only BSL-4 labs can work with agents for which no cure or treatment exists. GAO was asked to perform a systematic security assessment of key perimeter security controls at the nation's five operational BSL-4 labs. To meet this objective, GAO performed a physical security assessment of the perimeter of each lab using a security survey it developed. GAO focused primarily on 15 physical security controls, based on GAO expertise and research of commonly accepted physical security principles.
section_title: What GAO Found
paragraphs: Select Agent Regulations do not mandate specific perimeter security controls that need to be in place at each BSL-4 lab, resulting in significant differences in perimeter security between the nation's five labs. While three labs had all or nearly all of the key security controls GAO assessed--features such as perimeter barriers, roving armed guard patrols, and magnetometers in use at lab entrances--two labs demonstrated a significant lack of these controls. Specifically, one lab had all 15 security controls in place, one had 14, and another had 13 of the key controls. However, the remaining two labs had only 4 and 3 key security controls, respectively. Although the presence of the security controls GAO assessed does not automatically ensure a secure perimeter, having most controls provides increased assurance that a strong perimeter security system is in place and reduces the likelihood of unauthorized intrusion. For example, the two labs with fewer security controls lacked both visible deterrents and a means to respond to intrusion. One lab even had a window that looked directly into the room where BSL-4 agents were handled. In addition to creating the perception of vulnerability, the lack of key security controls at these labs means that security officials have fewer opportunities to stop an intruder or attacker. The two labs with fewer security controls were approved by the CDC to participate in the Select Agent Program despite their weaknesses. During the course of our review, GAO noted that the three labs with all or nearly all of the key security controls GAO assessed were subject to additional federal security requirements imposed on them by agencies that owned or controlled the labs, not because of the Select Agent Regulations.

section_title: Letter
paragraphs: Biosafety level (BSL) 4 laboratories (labs) handle the world’s most  dangerous biological agents and diseases—the Ebola virus, hemorrhagic  fevers, and smallpox, for example—in the hope that this work may result  in effective medical countermeasures or even a cure. In fact, of the four  BSL designations, only BSL-4 labs can work with agents for which no cure  or treatment exists. Although BSL-4 labs are required to protect the safety  of researchers and the general public, recent security incidents have  caused some concern. For example, in October 2007 GAO testified about  the lack of oversight and security concerns regarding BSL-3 and BSL-4  labs and identified an hour-long power outage due to lightning strikes, in  June 2007, at the Centers for Disease Control and Prevention’s (CDC)  newest BSL-4 facility. This incident raised questions about safety and  security, as well as the backup power system design, and showed that  even in the hands of experienced owners and operators, safety and  security of high-containment labs can still be compromised. Among other  things, the outage shut down the lab’s negative air pressure system, one of  the important components in place to keep dangerous agents from  escaping the containment areas.
Primary responsibility for regulatory control of select biological agents is  divided between the CDC and the U.S. Department of Agriculture (USDA)  under Select Agent Regulations—although some labs may have additional  security requirements imposed on them by agencies that own or control  these labs. While three of the BSL-4 labs are privately owned or operated  by academic institutions, the other two are owned and operated by the  federal government. As requested by the Department of Health and Human  Services (HHS), we are not including the names of the five labs in this  report for security reasons. Federal law requires all labs be registered with  the CDC’s Division of Select Agents and Toxins (DSAT) when handling  select agents that pose a severe threat to public health and safety,  including BSL-4 agents. Currently, all five operational BSL-4 labs are  registered with the CDC’s Select Agent Program and therefore are  regulated by the CDC, not USDA. This registration process requires each  lab to develop a security plan that is based on a site-specific risk  assessment. According to regulations, the security plan must be sufficient  to safeguard against unauthorized theft, loss, or release of select agents.  The DSAT inspection is intended to ensure that the labs meet certain  safety and security regulations, which vary according to the BSL ranking  of the select agent being handled. However, a recent report by HHS’s  Office of Inspector General (IG) stated that labs regulated under the  DSAT program had weaknesses in such areas as access control and  security plan implementation that could have compromised their ability to  safeguard select agents from accidental loss or theft.
Performing research on select agents is critical for the development of  effective medical countermeasures and, ultimately, the discovery of  vaccines. However, given recent security concerns and the threat of  biological terrorism, you are concerned that some BSL-4 labs could be  vulnerable to terrorist attack or agent theft. To address these concerns,  you requested that we perform a systematic physical security assessment  of key perimeter security controls at the five operational BSL-4 labs in the  United States.
To meet our objective, we reviewed the site-specific risk assessments and  security plans for each BSL-4 lab. We then performed a physical security  assessment limited to the perimeter of each lab using a security survey we  developed. We focused primarily on 15 physical security controls that  contribute to a strong perimeter physical security system based on our  expertise and research of commonly accepted physical security principles.  Although BSL-4 labs may have different levels of inherent risk, we  determined that these 15 controls (discussed in more detail in app. I)  represent a baseline for BSL-4 lab perimeter physical security. We  discussed the security of each lab with security personnel and lab officials  at the conclusion of each site visit. Finally, we interviewed DSAT and  Animal and Plant Health Inspection Service officials and reviewed the  CDC’s BSL-4 lab inspection reports.
For the purposes of this report, we defined physical security as the  combination of operational and security equipment, personnel, and  procedures used to protect facilities, information, documents, or material  against theft, sabotage, diversion, or other criminal acts. Our definition of  physical security excludes, and we did not evaluate, intelligence-gathering,  cybersecurity, and human capital training and effectiveness. We did not  assess the security of the labs themselves or the threat of an insider attack,  but focused on perimeter security leading up to the laboratory building  points of entry. Additionally, we did not test perimeter security controls to  determine whether they function as intended. Perimeter security is just  one aspect of overall security provisions under the Select Agent  Regulations, which includes personnel training and inventory control.  Select Agent Regulations also require additional security measures inside  the labs themselves, such as locks and other forms of physical control.
We conducted our assessment from December 2007 through September  2008 in accordance with standards prescribed by the President’s Council  on Integrity and Efficiency.
subsections: section_title: Background
paragraphs: The Public Health Security and Bioterrorism Preparedness and Response  Act of 2002 created the government’s Select Agent Regulations, dividing  primary responsibility for regulatory control of select biological agents  between HHS and USDA. While HHS is responsible for regulating select  agents that can potentially pose a severe threat to public health and safety,  USDA regulates select agents that can potentially pose a severe threat to  animal and plant health or animal and plant products. A number of  “overlap agents” can pose both a public health threat and a threat to  animals; in these cases, labs must register with either agency, but are not  required to register with both. As mentioned above, all five registered BSL- 4 labs in the United States are registered with DSAT.
When a lab registers with DSAT to handle a select agent, a site-specific  risk assessment must be conducted. Regulations governing the assessment  do not specify who must perform it, meaning that the assessment can be  performed by officials for the lab itself. Further, labs registering with  DSAT are required to develop and implement a written security plan based  on the site-specific risk assessment. According to the regulations, the  security plan must be sufficient to safeguard against unauthorized theft,  loss, or release of select agents and meet all the requirements outlined in  the Select Agent Regulations. DSAT authored and utilizes the Select  Agents and Toxins Security Information Document to provide possible  practices and procedures that entities may use to assist them in  developing and implementing their written security plans. Additional  requirements include a written biosafety or biocontainment plan that  describes the safety and containment procedures, and an incident  response plan that includes procedures for theft, loss, or release of an  agent or toxin; inventory discrepancies; security breaches; natural  disasters; violence; and other emergencies. Prior to being issued a  certificate of registration, an entity must comply with all security  requirements and all other provisions of the Select Agent Regulations. A  registration in the CDC’s Select Agent Program lasts for 3 years, after  which it must be renewed if the entity chooses to retain possession of the  select agents.
In addition to the five registered and operational BSL-4 labs, there are  more labs currently under construction or in the planning stages. While  expansion is taking place within the federal sector as well—there are  many new federal facilities currently under construction or planned,  which have one or more BSL-4 labs—there are also BSL-4 labs at  universities, as part of state response, and in the private sector. These new  facilities have not completed the registration process and were not fully  operational as BSL-4 labs at the time of our assessment.
section_title: Results of Security Assessment
paragraphs: CDC regulations do not mandate that specific perimeter security controls  are present at all BSL-4 labs, resulting in a significant difference in  perimeter security between the nation’s five labs. According to the  regulations, each lab must implement a security plan that is sufficient to  safeguard select agents against unauthorized access, theft, loss, or release.  However, there are no specific perimeter security controls that must be in  place at every BSL-4 lab. While three labs had all or nearly all of the key  security controls we assessed, two labs demonstrated a significant lack of  these controls.
The results of our perimeter physical security assessment of the five  registered BSL-4 labs are presented in table 1. The check marks in the  table indicate the presence of specific security features at the labs we  assessed, illustrating the varying levels of perimeter physical security  controls present at the labs.
Although the presence of the security controls we assessed does not  automatically ensure a secure perimeter, having most controls provides  increased assurance that a strong perimeter security system is in place and  reduces the likelihood of unauthorized intrusion. As discussed in appendix  I, the strongest perimeter security systems use an active, integrated  approach to security that takes advantage of multiple layers. For example,  an active, integrated system links perimeter intrusion alarms to a CCTV  network, allowing security officers to instantly view the location of an  alarm. A discussion of each security assessment follows.
Lab A: The physical security controls of Lab A presented a strong visible  deterrent from the outside, with 14 of the 15 key security controls in place.  Lab A was located in a complex of other buildings that was separated from  an urban environment by a perimeter security fence reinforced with airline  cable to further strengthen the fence and deter unauthorized access. A  roving patrol of armed guards was visible inside and outside the perimeter  fence, while other guards manned gated entry inspection points. The gates  incorporated technical support for the guards to assist them with the  inspection of both private and commercial vehicles. Guards conducted ID  checks at the gates and searched vehicles that did not have the  appropriate access decals. Further, all trucks were required to enter a  single gate containing an X-ray screening device. Past this outer perimeter,  a further man-made barrier existed around the building containing the  BSL-4 lab. Although Lab A had most of the security controls we focused on  during our assessment, it did not have an active intrusion detection system  integrated with the CCTV network covering the facility. This reduced the  possibility that security officers could detect and quickly identify an  intruder entering the building perimeter.
Lab B: Lab B was the only one of the five BSL-4 labs that had all 15  security controls. The lab was in an urban environment, but located in a  complex of other buildings enclosed within an outer fenced perimeter.  Roving patrols consisting of both armed security guards and local police  walked on the exterior of the perimeter fence. The fence itself was  reinforced with airline cable to further strengthen it along areas that  bordered roads, serving to further protect against unauthorized intrusion  from these public areas. There was a single gated inspection point to enter  the complex manned by armed security guards. The inspection point  incorporated technical support for the guards to assist them with the  inspection of both private and commercial vehicles. Once inside the gate,  man-made barriers and a natural (i.e., landscaped) barrier system stood  between the gate and the lab itself. More armed guards conducted roving  patrols inside the complex and guarded the entrance to the lab itself. Lab  B also had a strong active integrated security system. According to lab  officials, the system featured an integrated emergency management  response whereby appropriate fire and rescue vehicles were automatically  dispatched after an alarm.
Lab C: Lab C utilized only 3 of the 15 key security controls we assessed.  The lab was in an urban environment and publicly accessible, with only  limited perimeter barriers. During our assessment, we saw a pedestrian  access the building housing the lab through the unguarded loading dock  entrance. In addition to lacking any perimeter barriers to prevent  unauthorized individuals from approaching the lab, Lab C also lacked an  active integrated security system. By not having a command and control  center or an integrated security system with live camera monitoring, the  possibility that security officers could detect an intruder entering the  perimeter and respond to such an intrusion is greatly reduced.
Lab D: Although Lab D did not have an armed guard presence outside the  lab or vehicle screening, it presented strong physical security controls in  all other respects, with 13 of the key 15 controls we assessed. Lab D was  located within the interior of a complex of buildings, providing a natural  system of layered perimeter barriers that included bollards for vehicle  traffic. When combined with the presence of roving armed guard patrols,  Lab D projected strong visible deterrents. It also utilized an active  integrated security system so that if an alarm was activated, personnel  within the command and control center could survey the alarm area  though monitors and utilize pan/tilt/zoom cameras to further assess the  alarm area. This permits security personnel to better coordinate and  determine the appropriate response.
Lab E: Lab E was one of the weakest labs we assessed, with 4 out of the  15 key controls. It had only limited camera coverage of the outer perimeter  of the facility and the only vehicular barrier consisted of an arm gate that  swung across the road. Although the guard houses controlling access to  the facility were manned, they appeared antiquated. The security force  charged with protecting the lab was unarmed. Of all the BSL-4 labs we  assessed, this was the only lab with an exterior window that could provide  direct access to the lab. In lieu of a command and control center, Lab E  contracts with an outside company to monitor its alarm in an off-site  facility. This potentially impedes response time by emergency responders  with an unnecessary layer that would not exist with a command and  control center. Since the contracted company is not physically present at  the facility, it is not able to ascertain the nature of alarm activation.  Furthermore, there is no interfaced security system between alarms and  cameras and a lack of live monitoring of cameras.
DSAT approved the security plans for the two labs lacking most key  security controls, and approved these labs to participate in the Select  Agent Program as BSL-4 labs. Conversely, during our assessment, we  noted that the three BSL-4 labs with all or nearly all of our 15 key controls  were subject to additional federal security requirements outside the  purview of the Select Agent Regulations. For example, the National  Institutes of Health both funds research requiring high containment and  provides guidance and requirements that are widely used to govern many  of the activities in high-containment labs. Other examples of more  stringent regulations for BSL-4 labs include those of military labs that also  follow far stricter Department of Defense physical security requirements.  For example, Lab B had several layers of security, including a perimeter  security fence and roving patrol of armed guards, visible inside and  outside the perimeter fence. Although these security controls are not  necessary for BSL-4 labs registering with DSAT, Lab B utilized these  security controls to comply with more stringent federal requirements  imposed by the agency owning the facility and incorporated these controls  into its security plan. Security officials at the two labs with fewer security  controls (Labs C and E) told us that management and administration had  little incentive to improve security because they already met DSAT  requirements. Some security officials also suggested that budgetary  restrictions limited attempts to make security improvements.
section_title: Conclusions
paragraphs: Although numerous factors influence the security of a facility, two of the  BSL-4 labs we assessed were lacking key perimeter security controls even  though they met DSAT requirements. Our observation that the three labs  with strong perimeter security all were subject to additional federal  oversight outside of the DSAT program leads us to conclude that minimum  specific perimeter security standards would provide assurance that all  BSL-4 labs are held to the same security standard. Given that many new  BSL-4 labs are under construction and will come online over the next few  years, it is important for DSAT to ensure that there is no “weak link” in  security among the nation’s BSL-4 labs.
section_title: Recommendation for Executive Action
paragraphs: To further enhance physical perimeter security at BSL-4 labs regulated by  DSAT, we are recommending that the Director, CDC, take action to  implement specific perimeter security controls for all BSL-4 labs to  provide assurance that each lab has a strong perimeter security system in  place. The CDC should work with USDA to coordinate its efforts, given  that both agencies have the authority to regulate select agents.
section_title: Agency Comments and Our Evaluation
paragraphs: We received written comments on a draft of this report from the Assistant  Secretary for Legislation of HHS. HHS agreed that perimeter security is an  important deterrent against theft of select agents. They indicated that the  difference in perimeter security at the five labs was the result of risk-based  planning; however, they did not comment on the specific vulnerabilities  we identified (e.g., an unsecured loading dock at one building housing a  BSL-4 lab) and whether these should be addressed. In regard to requiring  specific perimeter controls at all BSL-4 labs, HHS stated that it would  coordinate with APHIS to seek input from physical security experts and  the scientific community; the regulated community; professional  associations; State, local, and tribal officials; and the general public as to  the need and advisability of requiring, by Federal regulation, specific  perimeter controls at each registered entity having a BSL-4 lab. They  explained that specific security controls are not in place because Select  Agent Regulations are focused on performance objectives rather than  specific methods of compliance. We are encouraged that HHS plans to  study this matter further, and suggest that, as part of this study, HHS  reconsider whether the lack of many specific perimeter security controls  at two of the nation’s five BSL-4 labs is acceptable.
HHS also requested that we provide references for the research that  identified our 15 security controls as being appropriate for the assessment  of the perimeter security of BSL-4 labs, identify the security experts that  we consulted, and indicate whether these 15 security controls had been  peer reviewed. We have notified HHS that we will work with them to  understand the controls in more detail. As discussed in our report, we  developed the 15 security controls based on our expertise in performing  security assessments and our research of commonly accepted physical  security principles. These principles are reflected in the security survey  tool we used to evaluate each of the five BSL-4 labs. We have used this  survey tool for similar security assessments in the past. Although we  acknowledge that the 15 security controls we selected are not the only  measures that can be in place to provide perimeter security, we  determined that these controls (discussed in more detail in app. I)  represent a baseline for BSL-4 lab perimeter physical security and  contribute to a strong perimeter security system. Many of these controls— such preventing direct access to a lab via windows, or ensuring visitors are  screened prior to entering a building containing a BSL-4 lab—are common- sense security measures.
HHS also provided us with technical comments, which we incorporated as  appropriate. HHS’s comment letter is reprinted in appendix II.
As agreed with your office, unless you announce the contents of this  report earlier, we will not distribute it until 30 days after its issue date. At  that time, we will send copies of this report to the Secretary of Health and  Human Services, the Director of the CDC, and other interested parties. The  report will also be available at no charge on the GAO Web site at  http://www.gao.gov.
If you or your staff have any questions concerning this report, please  contact me at (202) 512-6722 or kutzg@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on the  last page of this report. GAO staff who made major contributions to this  report are listed in appendix III.
section_title: Appendix I: Perimeter Security Controls
paragraphs: To perform our perimeter security assessment of biosafety level (BSL) 4  labs, we identified 15 key perimeter security controls, based on our  expertise and research of commonly accepted physical security principles,  that contribute to a strong perimeter security system. A strong perimeter  security system utilizes layers of security to deter, detect, delay, and deny  intruders.
Deter. Physical security controls that deter an intruder are intended to  reduce the intruder’s perception that an attack will be successful—an  armed guard posted in front of a lab, for example.
Detect. Controls that detect an intruder could include video cameras  and alarm systems. They could also include roving guard patrols.
Delay. Controls that delay an intruder increase the opportunity for a  successful security response. These controls include barriers such as  perimeter fences.
Deny. Controls that can deny an intruder include visitor screening that  only permits authorized individuals to access the building housing the  lab. Furthermore, a lack of windows or other obvious means of  accessing a lab is an effective denial mechanism.
Some security controls serve multiple purposes. For example, a perimeter  fence is a basic security feature that can deter, delay, and deny intruders.  However, a perimeter fence on its own will not stop a determined intruder.  This is why, in practice, layers of security must be integrated in order to  provide the strongest protection. Thus, a perimeter fence should be  combined with an intrusion detection system that would alert security  officials if the perimeter has been breached. A strong system would then  tie the intrusion detection alarm to the closed-circuit television (CCTV)  network, allowing security officers to immediately identify intruders. A  central command center is a key element for an integrated, active system.  It allows security officers to monitor alarm and camera activity—and plan  the security response—from a single location.
Table 2 shows 15 physical security controls we focused on during our  assessment work.
section_title: Appendix II: Comments from the Department of Health and Human Services
section_title: Appendix III: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Acknowledgments
paragraphs: In addition to the contact named above, the following individuals made  contributions to this report: Andy O’Connell, Assistant Director; Verginie  Amirkhanian; Randall Cole; John Cooney; Elizabeth Isom; Barbara Lewis;  Jeffrey McDermott; and Andrew McIntosh.