Homeland Security: Federal and Industry Efforts Are Addressing Security Issues at Chemical Facilities, but Additional Action Is Needed
Published: 2005-04-27T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Terrorist attacks on chemical facilities could severely damage the U.S. economy and public health. About 15,000 facilities produce, use, or store large amounts of chemicals that pose the greatest risk to human health and the environment. While the Environmental Protection Agency (EPA) formerly had the lead role in federal efforts to ensure chemical facility security, the Department of Homeland Security (DHS) is now the lead federal agency responsible for coordinating government and private efforts to protect these facilities from terrorist attacks. This testimony is based on GAO's past work on chemical facility security and focuses on (1) the attractiveness of chemical facilities as terrorist targets, (2) their diversity and risks, (3) federal security requirements for these facilities, and (4) federal and industry efforts to improve facility security.
section_title: What GAO Found
paragraphs: Experts agree that the nation's chemical facilities are attractive targets for terrorists. The theft or release of certain chemicals could disrupt the local economy, impact other critical infrastructures that rely on chemicals, or impact the health and safety of millions of Americans. For example, a 2002 Brookings Institution report ranks an attack on toxic chemical plants behind only biological and atomic attacks in terms of possible fatalities. While several efforts are underway, no one has yet comprehensively assessed security at the nation's chemical facilities. The chemical sector includes a variety of facilities and risks. The 15,000 facilities with large amounts of the most dangerous chemicals include chemical manufacturers, water supply facilities, and fertilizer facilities, among others. Some facilities may be at higher risk of a terrorist attack than others because of the specific chemicals on site and their proximity to population centers. According to 2003 EPA data, 123 U.S. chemical facilities had "worst-case" scenarios where more than one million people could be at risk of exposure to a cloud of toxic gas. While EPA and DHS believe that these scenarios overstate the potential consequences of a chemical release, there are situations where an attack could have potentially more severe consequences. Only about one-sixth of the 15,000 facilities with large amounts of dangerous chemicals are covered by federal security requirements. About 2,000 community water systems and 238 facilities that are located on waterways and handle "bulk liquid chemicals" must conduct vulnerability assessments, among other things, under the Public Health Security and Bioterrorism Response Act of 2002 and the Maritime Transportation Security Act of 2002, respectively. However, the federal government places requirements on chemical facilities to address accidental releases, which may also reduce the likelihood and mitigate the consequences of terrorist attacks. A number of federal and industry efforts are underway to enhance chemical facility security. DHS is developing a strategy to protect the chemical sector, identify high-risk facilities, and integrate chemical sector protection efforts into a national program. With no authority to require facilities to improve security, DHS has provided the industry with financial assistance, information, and training, assessed facility vulnerability, and recommended security improvements. About 1,100 facilities participate in a voluntary industry effort in which they assess vulnerabilities, develop security plans, and undergo a third party verification that the facilities implemented the identified physical security enhancements. The extent to which the remaining facilities are addressing security is unclear and the extent of chemical facilities' security preparedness is unknown. In this context, a comprehensive national strategy to identify high-risk facilities and require facilities to assess their vulnerabilities, among other actions, would help to ensure that security vulnerabilities at chemical facilities are addressed.

section_title: Letter
paragraphs: Thank you for this opportunity to discuss our work on chemical facility  security. As the events of September 11, 2001, showed, a terrorist attack  on infrastructure that is critical to our nation’s economy can cause  enormous damage to our country and jeopardize public health and safety.  The USA PATRIOT Act defined critical infrastructure as those “systems  and assets…so vital to the United States that the incapacity or destruction  of such systems and assets would have a debilitating impact on security,  national economic security, national public health or safety, or any  combination of those matters.” We often take these systems for granted  because they are so basic in our daily lives that we generally only notice  them when their service is interrupted. The President’s February 2003  National Strategy for the Physical Protection of Critical Infrastructures  and Key Assets sets forth the federal government’s goals, objectives, and  responsibilities in protecting the nation’s critical infrastructure. The  strategy, as well as a presidential directive issued in December 2003,  identified the chemical industry among the sectors that are critical to the  nation’s infrastructure. The chemical sector produces, uses, stores, and  distributes the chemicals needed to manufacture thousands of products,  such as those used in agriculture, pharmaceuticals, and automobiles.
The national strategy states that the private sector bears primary  responsibility for protecting their facilities from deliberate acts of  terrorism. While federal, state, and local governments work in partnership  with the private sector to protect chemical facilities, before September 11,  2001, attention was largely focused on the risks of accidental, rather than  intentional, chemical releases. In this regard, the Environmental  Protection Agency (EPA) regulates about 15,000 facilities under the Clean  Air Act because they produce, use, or store more than certain threshold  amounts of specific chemicals that would pose the greatest risk to human  health and the environment if accidentally released into the air. These  facilities must take a number of steps, including preparing a risk  management plan (RMP), to prevent and prepare for an accidental release  and, therefore, are referred to as “RMP” facilities. While EPA initially had  the lead responsibility for protecting the chemical infrastructure sector,  the Department of Homeland Security (DHS) is now the lead federal  agency. DHS is responsible for coordinating the efforts of government and  private institutions to protect critical infrastructure, including the  chemical sector, from terrorist attacks.
My remarks today are based on our March 2003 and March 2005 reports,  and will focus on (1) experts’ views on the attractiveness of chemical  facilities as terrorist targets, (2) the diversity of these facilities and their  risks, (3) federal requirements that address security at these facilities, and  (4) an overview of steps the federal government and industry have taken  to improve facility security. For this work, we interviewed officials from  EPA, DHS, and the Department of Justice; reviewed pertinent federal  legislation, EPA data, and available reports; and interviewed industry  representatives from the American Chemistry Council, other industry  associations, and a number of chemical companies. We conducted our  work according to generally accepted government auditing standards. We  are currently reviewing ongoing federal and industry efforts to improve  chemical facility security, including the need for further regulation. We  plan to issue a report on our findings later this year.
subsections: section_title: Background
paragraphs: The Homeland Security Act of 2002 established DHS and set forth its  mission to, among other things, prevent terrorist attacks within the United  States, reduce the vulnerability of the United States to terrorism, and  minimize the damage and assist in the recovery from terrorist attacks that  do occur within the United States. Following passage of the act, a  December 2003 presidential directive states that DHS is responsible for  coordinating the overall national effort to enhance the protection of the  critical infrastructure and key resources of the United States. The  Secretary of Homeland Security serves as the principal federal official to  lead, integrate, and coordinate the implementation of efforts among  federal departments and agencies, state and local governments, and the  private sector to protect critical infrastructure and key resources. The  directive identified the chemical sector as a critical infrastructure sector  along with other sectors, including agriculture, banking and finance,  defense industrial base, emergency services, energy, food, government,  information and telecommunications, postal and shipping, public health,  transportation, and water. Under this presidential directive, DHS is now  the lead agency for the chemical infrastructure sector, a change from  national strategies issued in July 2002 and February 2003, which named  EPA as the lead federal agency.
The presidential directive emphasized those critical infrastructure and key  resources that could be exploited to cause catastrophic health effects or  mass casualties. Because many chemicals are inherently hazardous, the  release of chemicals or the risk of contamination at chemical facilities  poses a potential threat to public health and the economy. Under the Clean  Air Act’s Risk Management Program provisions, EPA identified 140 toxic  and flammable chemicals that, when present above certain threshold  amounts, would pose the greatest risk to human health and the  environment if released accidentally into the air. According to EPA,  approximately 15,000 facilities in a variety of industries produce, use, or  store one or more of these chemicals beyond threshold amounts in one or  more processes (e.g., single or interconnected vessels or tanks).
Before these functions were transferred to DHS by the Homeland Security  Act of 2002, Justice was responsible for collecting information from the  U.S. intelligence community, the FBI’s criminal investigations, other  federal agencies, and the private sector about threats, including those  involving chemicals. The Chemical Safety Information, Site Security and  Fuels Regulatory Relief Act required Justice to review the vulnerability of  chemical facilities to terrorist or criminal attack and report this  information to the Congress. Justice prepared and submitted an interim  report to Congress in May 2002 based on observations made at 11  chemical manufacturing facilities.
section_title: Experts Agree that Chemical Facilities Are an Attractive Target for Terrorists
paragraphs: Experts agree that the nation’s chemical facilities present an attractive  target for terrorists intent on causing massive damage. Many facilities  house toxic chemicals that could become airborne and drift to  surrounding communities if released or could be stolen and used to create  a weapon capable of causing harm. Justice has been warning of the  terrorist threat to chemical facilities for a number of years and has  concluded that the risk of an attempt in the foreseeable future to cause an  industrial chemical release is both real and credible. Based on analysis of  trends in international and domestic terrorism and the burgeoning interest  in weapons of mass destruction among criminals and terrorists, Justice  warned of potential targeting by terrorists of chemical facilities before the  events of September 11, 2001. In fact, according to Justice, domestic  terrorists plotted to use a destructive device against a U.S. facility that  housed millions of gallons of propane in the late 1990s. In testimony on  February 6, 2002, the Director of the Central Intelligence Agency also  warned of the potential for an attack by al Qaeda on chemical facilities.
Terrorist attacks involving the theft or release of certain chemicals could  have a significant impact on the health and safety of millions of  Americans. The disaster at Bhopal, India in 1984, when methyl isocyanate  gas—a highly toxic chemical—leaked from a tank, reportedly killing about  3,800 people and injuring anywhere from 150,000 to 600,000 others,  illustrates the potential threat to public health from a chemical release.  While U.S. chemical facilities are subject to a number of safety  requirements, the Army has estimated high potential damage to the U.S.  population from an intentional toxic chemical release. During a 2001  informal meeting with a number of agencies, the Army Office of the  Surgeon General proposed, based on generic estimates, that it was  conceivable that as many as 2.4 million people could request medical  treatment if a terrorist caused the release of a toxic chemical. According  to officials from that office, these estimates include anyone who seeks  medical attention as a result of the release—including people with minor  irritations or concerns. Similarly, a 2002 Brookings Institution report ranks  an attack on toxic chemical plants behind only biological and atomic  attacks in terms of possible fatalities. In January 2005 testimony before  the Senate Committee on Homeland Security and Governmental Affairs on  challenges facing DHS, a Brookings Institution Visiting Fellow identified  chemical facility security as a priority for DHS, noting that toxic industrial  chemicals present the potential for mass casualties from a terrorist attack  that is rivaled only by improvised nuclear devices, certain acts of  bioterrorism, and the collapse of large, occupied buildings.
In addition to the potential loss of life, a terrorist attack on a chemical  facility could also disrupt the local or regional economy or impact other  critical infrastructures. The chemical manufacturing industry produces the  chemicals used in agriculture, pharmaceuticals, drinking water and  wastewater treatment systems, and food processing. DHS’ February 2005  Interim National Infrastructure Protection Plan notes that many critical  infrastructure assets are dependent on multiple elements and systems to  remain functional. In some cases, a failure in one sector will have a  significant impact on the ability of another sector to perform necessary  functions. For example, rail transportation of many hazardous materials  including chlorine was disrupted in some states following the events of  September 11, 2001, because of concern about the potential for an  intentional chemical release. This disruption to rail service impacted  drinking water facilities that relied on chlorine delivered by rail to purify  water.
Currently, no one has comprehensively assessed security across the nation  at facilities that house chemicals. Both EPA and DHS officials have visited  some chemical facilities to discuss security since September 11, 2001, but  the results of these visits are not publicly available. EPA visited 30 high- risk chemical facilities to discuss security, and DHS has visited a number  of chemical facilities to assist owner/operators in assessing vulnerabilities  at their facilities. During a limited review of chemical industry  vulnerabilities conducted at 11 facilities primarily before September 11,  2001, Justice found that some chemical facilities may need to implement  more effective security systems and develop alternative means to reduce  the potential consequences of a successful attack. The effectiveness of  security at some facilities may also be in doubt as evidenced by several  media accounts of reporters and environmental activists gaining access to  chemical tanks and computer centers that control manufacturing  processes at facilities in 2001, 2002, and 2003.
section_title: Chemical Infrastructure Sector Includes Many Types of Facilities with Different Risks
paragraphs: DHS has not yet determined the number and type of facilities that should  be considered as part of the chemical infrastructure sector. The universe  of chemical facilities is diverse in that they produce, use or store a host of  products, including (1) basic chemicals used to manufacture other  products such as fertilizers, plastics, and synthetic fibers; (2) specialty  chemicals used for a specific purpose such as a functional ingredient or a  processing aid in the manufacture of a range of products such as adhesives  and solvents, coatings, industrial gases and cleaners, and water  management chemicals; (3) life science chemicals consisting of  pharmaceuticals and pesticides; and (4) consumer products such as hair  and skin products and cosmetics. In total, about 15,000 RMP facilities  produce, use, or store more than threshold amounts of one or more of the  140 toxic and flammable chemicals that EPA has estimated pose the  greatest risk to human health and the environment if accidentally released  into the air. Approximately 4,000 facilities manufacture these chemicals,  and numerous other types of facilities—agricultural suppliers such as  fertilizer facilities, food storage facilities, pulp and paper manufacturers,  iron and steel mills, and computer manufacturing facilities—also house  large quantities of chemicals. While the universe of chemical facilities is  diverse, some of these facilities are part of other critical infrastructure  sectors. For example, about 2,000 of these facilities are community water  systems that are part of the water infrastructure sector.
Some facilities may be at higher risk of a terrorist attack than others  because of the chemicals they house and their proximity to population  centers. Toxic chemicals such as chlorine and ammonia could form a toxic  cloud and drift over neighboring populations if released, while flammable  chemicals such as butane and hydrogen could be used in destructive  devices. Assuming that the objective of an attack is a catastrophic release  of a toxic chemical, attacks on such facilities could harm a large number  of people with health effects ranging from mild irritation to death. No  specific data are available on what the actual effects of successful terrorist  attacks on chemical facilities would be. However, RMP facilities submit to  EPA estimates of the potential consequences to surrounding communities  of hypothetical “worst-case” accidental chemical releases from their  facilities. These estimates include the residential population located within  the range of a toxic gas cloud produced by a “worst-case” chemical  release, called the “vulnerable zone.” According to 2003 EPA data, 123  chemical facilities located throughout the nation had toxic “worst-case”  scenarios where more than one million people would be in the “vulnerable  zone” and could be at risk of exposure to a cloud of toxic gas. About 600  facilities could each potentially threaten between 100,000 and a million  people, and about 2,300 facilities could each potentially threaten between  10,000 and 100,000 people within these facilities’ “vulnerable zones.”
According to EPA and DHS, the method for calculating “worst-case”  scenario calculations for RMP facilities overstates the potential  consequences of a chemical release. The scenarios do not consider the  potential causes of a release or how different causes or other  circumstances, such as safety features, could lessen the consequences of a  release. Furthermore, the scenarios’ “vulnerable zones” include the  population in the entire area surrounding the facility, while the wind  would typically carry the toxic cloud in one direction affecting only a  portion of the area. While officials believe these scenarios are overstated,  there are situations where an attack could result in larger consequences.  EPA regulations require RMP facilities to estimate the effects of a toxic  chemical release involving the greatest amount of the toxic chemical held  in a single vessel or pipe, rather than the entire quantity on site. Therefore,  for some facilities, an attack could breach multiple chemical vessels  simultaneously and could result in a larger release with potentially more  severe consequences than estimated in the “worst-case” scenario.
section_title: Few Federal Requirements Address Security at the Nation’s Chemical Facilities
paragraphs: Currently, few federal requirements address security at U.S. chemical  facilities. While some chemical facilities must comply with the Public  Health Security and Bioterrorism Response Act of 2002 (Bioterrorism Act)  and the Maritime Transportation Security Act of 2002 (MTSA), many are  not subject to any federal security requirements. The Bioterrorism Act  requires community water systems serving more than 3,300 people to  perform vulnerability analyses of their facilities, among other things. Many  of these facilities may store hazardous chemicals for water treatment and  are not required to implement any risk reduction actions based on their  vulnerability assessments or report to EPA on measures that have been  implemented. EPA estimated in 2003, that approximately 2,000 RMP  facilities may be community water systems covered under the  Bioterrorism Act. MTSA and its implementing regulations require maritime  facility owners and operators to conduct assessments of certain at-risk  facilities to identify vulnerabilities, develop security plans to mitigate these  vulnerabilities, and implement the measures discussed in the security  plans. According to the Coast Guard, 238 chemical facilities are located on  waterways and handle “bulk liquid chemicals” are subject to MTSA  requirements.
The remaining chemical facilities, including the approximately 13,000 RMP  facilities, are subject to no federal requirements specifically related to  improving security against terrorist attacks. Although these facilities pose  different levels of risk depending on the chemicals they use or store,  thousands house quantities of toxic chemicals that could impact  neighboring populations if released. The security requirements for the  chemical sector stand in contrast to a number of other critical  infrastructure sectors that are subject to federal security requirements. In  addition to community water systems, all commercial nuclear power  plants licensed by the Nuclear Regulatory Commission are subject to a  number of security requirements, including placing physical barriers  outside the operating reactor area, limiting access to vital areas,  maintaining a trained security force, and conducting simulated terrorist  attack exercises.
While the federal government does not require all chemical facilities to  take security measures to protect against a terrorist attack, it does impose  safety and emergency response requirements on chemical facilities, which  may incidentally reduce the likelihood and mitigate the consequences of  terrorist attacks. For example, the Emergency Planning and Community  Right to Know Act requires owners and operators of facilities that  maintain specified quantities of certain extremely hazardous chemicals to  annually submit information on their chemical inventory to state and local  emergency response officials. This information is used to help prepare  community response plans in the event of a chemical incident. Under  Section 112(r) of the Clean Air Act, EPA’s Risk Management Program  requires owners and operators of facilities that handle listed extremely  hazardous substances over a threshold amount to prepare and implement  a risk management plan to detect and prevent or minimize accidental  releases. In addition to evaluating “worst-case” accidental release  scenarios, facility owners and operators must implement a program to  prevent accidental releases that includes safety precautions and  maintenance, monitoring, training measures, and must have an emergency  response plan. The Department of Labor’s Occupational Safety and Health  Administration’s process safety management standard also requires  facilities to assess and address the hazards of their chemical process.  These requirements could potentially mitigate a terrorist attack by (1)  providing an incentive to facilities to reduce or eliminate chemicals below  regulated threshold levels, (2) requiring facilities to implement measures  to improve the safety of areas that are vulnerable to a chemical release,  and (3) facilitating emergency response planning that increases  preparedness for a chemical release—whether intentional or  unintentional.
section_title: Federal Government and Industry Have Taken Steps to Improve Facility Security, but Further Action Is Needed
paragraphs: The federal government and the chemical industry have taken a number of  steps to enhance security at chemical facilities. DHS’ Information Analysis  and Infrastructure Protection Directorate has a number of initiatives  underway to develop a strategy for protecting the chemical sector, identify  high-risk facilities, and integrate chemical sector protection efforts into a  national program. In February 2005, DHS released an Interim National  Infrastructure Protection Plan. While we have not yet fully evaluated this  plan, it outlines a risk management framework to guide future efforts to  identify and protect critical infrastructure and defines the roles of federal,  state, local, and tribal agencies and the private sector. DHS is also  developing a vulnerability and risk assessment methodology designed to  assist facilities with analyzing security, help DHS rank these facilities by  risk, and allow DHS to compare assets across sectors.
Without specific authority to require that chemical facilities make security  improvements, DHS has worked voluntarily with the chemical industry to  provide financial assistance, share information about critical  infrastructure protection, provide training and exercises, and assess  facility vulnerabilities and recommend security improvements. DHS has  provided training programs to first responders and facility security officers  and held drills at chemical facilities. DHS has also provided advice and  guidance to state and local partners to reduce vulnerabilities in buffer  zones (the area extending from the facility to the surrounding community)  and conducted site assistance visits.
The chemical sector, led by its industry associations, also has voluntary  initiatives underway at member facilities. Industry associations have  issued security guidance, identified security best practices, and developed  vulnerability assessment methodologies specific to their members. In  addition, industry is assisting DHS in developing a methodology for  assessing risk in the chemical sector. To provide a mechanism for  coordinating with DHS, in June 2004, the chemical industry established the  Chemical Sector Council to identify, prioritize, and coordinate the  protection of the industry’s critical infrastructure and key resources, and  to facilitate the sharing of information about physical and cyber threats,  vulnerabilities, incidents, potential protective measures, and best  practices. The Council is composed of 16 sector associations representing  a range of chemical facilities.
The primary security initiative undertaken by the industry directs  participating chemical facilities to assess vulnerabilities and develop  security plans to address them. In this regard, the American Chemistry  Council (ACC)—whose members own or operate approximately 1,000 (or  about 7 percent) of the 15,000 RMP facilities—requires its members to  perform vulnerability assessments, develop plans to mitigate  vulnerabilities, and take actions to implement the plans. Companies are  then required to have third parties such as local emergency responders or  local law enforcement officials verify that physical security enhancements  identified in facility plans were implemented. These third parties are not  required, however, to verify that the vulnerability assessment is  appropriately conducted and that the actions taken by the facility  adequately address security risks.
ACC also has a new requirement that independent auditors certify that  member companies have management systems in place. These audits will  confirm that companies have security programs and processes. According  to ACC, all of its members have conducted vulnerability assessments, and  most have completed security enhancements and had them verified. The  Synthetic Organic Chemical Manufacturers Association (SOCMA), which  represents manufacturers who produce specialty chemicals at small- to  medium-sized facilities, also adopted these security requirements for all of  their member facilities, which include 77 of the 15,000 RMP facilities.
ACC and SOCMA’s self-initiated membership requirements incorporate  elements of a risk management framework, which can aid in assessing risk  by determining which vulnerabilities should be addressed in what ways  within available resources, and were designed to strengthen security at  facilities that comply with its requirements. The actions required by  Responsible Care® may exceed efforts taken by non-participating  facilities.
Despite these efforts, the overall extent of security preparedness at  chemical facilities is unknown. While DHS has a number of programs  underway to identify high-risk facilities and assess their vulnerabilities,  these programs are in their infancy. As a result, neither DHS nor any other  federal entity has yet assessed the overall extent of security preparedness  at the nation’s chemical facilities. While chemical industry associations  have worked closely with member companies to evaluate and improve  security at facilities, the extent of participation in voluntary initiatives is  unclear. EPA officials estimated in 2003, that voluntary initiatives led by  industry associations only reach a portion of the 15,000 RMP facilities.  Further, EPA and DHS have stated publicly that voluntary efforts alone are  not sufficient to assure the public of the industry’s preparedness. In this  context, a comprehensive national chemical security strategy that would,  among other actions, identify high-risk facilities and require facilities to  assess their vulnerabilities and take any needed corrective actions would  help to ensure that security vulnerabilities at chemical facilities are  addressed.
section_title: Conclusions
paragraphs: Across the nation, thousands of industrial facilities manufacture, use, or  store hazardous chemicals in quantities that could potentially put large  numbers of Americans at risk of injury or death in the event of a chemical  release. Experts agree that chemical facilities are an attractive target to  terrorists because of the potential to harm large numbers of people and  disrupt the economy or other critical infrastructures. Yet, despite efforts  since September 11, 2001, to protect the nation from terrorism, the extent  of security preparedness at U.S. chemical facilities is unknown. While  some other critical infrastructures are required to assess their  vulnerabilities, no federal requirements are in place to require all chemical  facilities to assess their vulnerabilities and take steps to reduce them. Both  the federal government and the chemical industry have taken steps to  improve security at chemical facilities. However, these efforts have not  involved all facilities with significant quantities of hazardous chemicals on  site. Further action is needed to ensure that the nation’s chemical  facilities—which produce, use, and store chemicals vital to the  manufacture of a range of everyday products—are assessing security  vulnerabilities and taking actions to address them.
Madame Chairman, this concludes our prepared statement. We would be  happy to respond to any questions that you or Members of the Committee  may have.
section_title: Contacts and Acknowledgments
paragraphs: For further information about this testimony, please contact me at (202)  512-3841. Jill Edelson, Joanna Owusu, Debra B. Sebastian, Amy Webbink,  Leigh White, and Vincent P. Price made key contributions to this  statement.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. It may be reproduced and distributed in its entirety without further  permission from GAO. However, because this work may contain copyrighted images or  other material, permission from the copyright holder may be necessary if you wish to  reproduce this material separately.