Critical Infrastructure Protection: Improvements Needed for DHS's Chemical Facility Whistleblower Report Process
Published: 2016-07-12T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The CFATS program is intended to ensure the security of the nation's chemical infrastructure by assessing risks and requiring the implementation of measures to protect high-risk chemical facilities. The CFATS Act of 2014 required DHS to establish a whistleblower process. Employees and contractors at hundreds of thousands of U.S. facilities with hazardous chemicals can play an important role in helping to ensure CFATS compliance by submitting a whistleblower report when they suspect noncompliance. Whistleblowers who disclose wrongdoing at chemical facilities can save lives and help improve public safety and health.
The CFATS Act of 2014 also requires GAO to review the CFATS whistleblower process. This report addresses (1) the number and types of CFATS whistleblower reports DHS received, and any actions DHS took as a result, and (2) the extent to which DHS has implemented and followed a process to address the whistleblower reports, including reports of retaliation against whistleblowers. GAO reviewed laws, regulations, and CFATS program documents; analyzed whistleblower reports DHS received from June 16, 2015 to April 19, 2016; and interviewed officials responsible for vetting the reports and deciding how to address them.
section_title: What GAO Found
paragraphs: Of the 105 reports that the Department of Homeland Security (DHS) received under its interim process for whistleblowers from June 16, 2015 (the date DHS was mandated to begin collecting reports by), to April 19, 2016, DHS closed 97 because they did not pertain to Chemical Facility Anti-Terrorism Standards (CFATS) regulations, and referred 70 of the 97 to other federal agencies with legal authority relevant to the reports. DHS determined that 8 of the 105 reports involved potential CFATS violations, and after further review, that 1 report involved an actual CFATS violation. As a result of this report, DHS required the chemical facility to register with DHS as a CFATS-regulated facility.
Total Reports Received by DHS and Disposition for Reports, June 16, 2015 to April 19, 2016
In June 2015, DHS implemented an interim process to respond to whistleblower reports involving CFATS and has followed its process since then; however, DHS does not have a documented process and procedures to investigate whistleblower retaliation reports. The Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014 (CFATS Act of 2014) prohibits retaliation against whistleblowers. According to DHS, the department has not received a report of whistleblower retaliation that it substantiated since implementing the interim process and any future retaliation reports would be addressed on a case-by-case basis. However, without a documented process and procedures for investigating whistleblower retaliation reports, DHS may not be able to effectively and efficiently investigate any future retaliation reports. In addition, DHS maintains a telephone tip line and a website with an e-mail address to receive CFATS whistleblower reports. However, the tip line greeting provides no guidance and the website provides limited guidance about the type of information that would be most useful to DHS for addressing the reports. GAO's analysis of 105 reports received by DHS from June 16, 2015, to April 19, 2016, identified challenges that DHS experienced in vetting reports due to insufficient information, such as the name or location of the chemical facility. Additional guidance explaining the detailed information that DHS needs to review reports could help reduce the amount of follow-up time to obtain this information.
section_title: What GAO Recommends
paragraphs: GAO recommends that DHS develop a documented process and procedures to address whistleblower retaliation reports, and provide additional guidance on the DHS whistleblower website and telephone tip line. DHS agreed with GAO's recommendations.

section_title: Letter
paragraphs: Facilities that produce, use, or store hazardous chemicals can pose  significant risks and danger to workers and the general public if chemicals  are not properly produced, handled, and stored. Terrorists who want to  inflict significant casualties and damage may target chemical facilities in  the United States, which has hundreds of thousands of chemical facilities.  The Department of Homeland Security’s (DHS) Chemical Facility Anti- Terrorism Standards (CFATS) program, enacted in 2007, enables the  department to identify chemical facilities and assess the security risk  posed by each, categorize the facilities into risk-based tiers, and inspect  the high-risk facilities to ensure compliance with regulatory requirements  and reduce the risks associated with chemicals of interest (COI). As of  September 30, 2015, DHS had designated 3,127 facilities in the United  States as high-risk chemical facilities subject to CFATS. We previously  reported on CFATS and identified challenges that DHS was experiencing  in implementing the program. We recommended, among other things,  that DHS enhance its risk assessment approach to incorporate all  elements of risk, conduct a peer review of the program to validate and  verify DHS’s risk assessment approach, verify that certain data reported  by facilities are accurate, and document processes and procedures for  managing compliance with site security plans. DHS agreed with all of our  recommendations and implemented some of them, such as verifying  facility data accuracy, as of May 2016.
The Protecting and Securing Chemical Facilities from Terrorist Attacks  Act of 2014 (CFATS Act of 2014) mandated that, among other things,  DHS establish a procedure to facilitate whistleblower reporting—reports  of potential CFATS violations from employees and contractors at  chemical facilities of interest—within 180 days of the enactment of the act  (that is, by June 16, 2015). Employees and contractors who are on site  and involved in facilities’ day-to-day operations can play an important role  in notifying DHS of failures to comply with CFATS by submitting a  whistleblower report. Whistleblowers who disclose wrongdoing at  chemical facilities can save lives and contribute to improvements in public  safety and health, and facility operations. DHS’s National Protection and  Programs Directorate’s (NPPD) Infrastructure Security Compliance  Division (ISCD) is, among other things, responsible for managing the  CFATS program, including its whistleblower process and procedures.
The CFATS Act of 2014 includes a provision for GAO to evaluate the  implementation of DHS’s CFATS whistleblower protections provided  under the act. This report determines (1) the number and types of  CFATS whistleblower reports DHS received, and any actions DHS took  as a result of the reports, and (2) the extent to which DHS has  implemented and followed a process to address reports from the  whistleblowers, including reports of retaliation against whistleblowers.
To determine the number and types of whistleblower reports DHS  received, and any actions DHS took as a result, we reviewed all reports  that ISCD received from June 16, 2015 to April19, 2016, and analyzed  the types of issues reported in the reports. We interviewed ISCD officials,  who were responsible for vetting and deciding what to do with these  reports, about any actions taken to address them. We also reviewed  documentation from ISCD, such as the electronic spreadsheet for  recording and tracking the reports, and documentation between the  individuals who submitted the reports and ISCD, to evaluate ISCD’s  actions from initial receipt of the report to determining whether or not a  CFATS violation had occurred. We assessed the reliability of the data for  the reports by, for example, reviewing ISCD’s standard operating  procedures for receiving and documenting CFATS reports received on  the telephone tip line and by e-mail, and interviewing knowledgeable  officials to identify internal controls to ensure the completeness and  accuracy of the information in the electronic spreadsheet. We determined  the data to be sufficiently reliable for purposes of determining the number  of reports received by ISCD and the types of issues reported. In addition,  for context, we reviewed the CFATS telephone tip line calls that ISCD  received from February 2009 (when ISCD created its telephone tip line for  potential CFATS violations) to June 15, 2015 (the day prior to ISCD’s  implementation of its interim process for addressing reports) to identify  the number of calls received and the types of issues reported. We  assessed the reliability of the data for the calls by, for example, reviewing  ISCD’s standard operating procedures for receiving and documenting  CFATS tip line calls, interviewing knowledgeable officials, and reviewing  guidance to understand how the calls are received and transcribed. We  determined the data to be sufficiently reliable for purposes of determining  the number of calls received by ISCD and the types of issues reported.
To determine the extent to which DHS has implemented and followed a  process to address reports from CFATS whistleblowers, we reviewed the  CFATS Act of 2014, the ISCD interim process for addressing reports of  potential CFATS violations, and ISCD’s spreadsheet that documents  ISCD officials’ review, actions taken, and decisions about each report  received since June 16, 2015, when ISCD implemented its interim  process. We interviewed DHS officials responsible for vetting and making  decisions about reports received from June 16, 2015 to April 19, 2016  (the date of ISCD’s last data update to us). We also identified provisions  related to whistleblower protections in the CFATS Act of 2014, and  analyzed ISCD’s interim process for addressing reports to determine if  ISCD has a process and procedures for each applicable provision in the  CFATS Act of 2014 and if ISCD implemented its process and procedures  since June 16, 2015, for each applicable provision in the CFATS Act of  2014. In addition, we interviewed officials from three other federal  agencies—Department of Labor’s Occupational Safety and Health  Administration (OSHA), Nuclear Regulatory Commission, and  Environmental Protection Agency (EPA)—to learn about practices they  use in their existing whistleblower programs. Furthermore, we interviewed  officials at all three sector coordinating councils and all three labor  organizations, who ISCD officials said they met with, to determine if ISCD  worked in partnership with industry and labor to inform them of ISCD’s  whistleblower process and rights that a CFATS whistleblower would have  under federal law. We compared ISCD’s processes to Standards for  Internal Control in the Federal Government to identify the extent to which  DHS’s process was in alignment with these standards. Additional details  on our scope and methodology are discussed in appendix I.
We conducted this performance audit from September 2015 to July 2016  in accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: DHS’s NPPD leads the national effort to protect and enhance the  resilience of the nation’s physical and cyber infrastructure. The directorate  includes the Office of Infrastructure Protection, which leads the  coordinated national effort to reduce risk to U.S. critical infrastructure  posed by acts of terrorism. Within the Office of Infrastructure Protection,  ISCD leads the nation’s effort to secure high-risk chemical facilities and  prevent the use of certain chemicals in a terrorist act on the homeland, as  well as implementing CFATS and managing the CFATS program,  including its whistleblower process and procedures.
The CFATS program is intended to ensure the security of the nation’s  chemical infrastructure by identifying, assessing the risk posed by, and  requiring the implementation of measures to protect high-risk chemical  facilities. Section 550 of the DHS Appropriations Act, 2007, required DHS  to issue regulations establishing risk-based performance standards for  chemical facilities that, as determined by DHS, present high levels of risk;  the act also required vulnerability assessments and development and  implementation of site security plans for such facilities. DHS published  the CFATS interim final rule in April 2007 and appendix A to the rule,  published in November 2007, lists 322 COI and the screening threshold  quantities for each. According to DHS, subject to certain statutory  exclusions, all facilities that manufacture COI as well as facilities that  store or use such chemicals as part of their daily operations may be  subject to CFATS. However, only chemical facilities determined to  possess a requisite quantity of COI (that is, the screening threshold  quantity) and subsequently determined to present high levels of security  risk—that is, covered facilities—are subject to the more substantive  requirements of the CFATS regulation. The CFATS Act of 2014  amended the Homeland Security Act of 2002 by adding the Chemical  Facility Anti-Terrorism Standards as Title XXI and, in effect, authorizing  the program for an additional 4 years. Among other things, the act  expressly repeals DHS’s authority to implement the program under  section 550 of the DHS Appropriations Act, 2007, but also expressly  provides that the CFATS regulation promulgated under that authority shall  remain in effect unless otherwise amended, consolidated, or repealed.  Consequently, while the act imposes new and additional responsibilities  on DHS to implement the CFATS program, including a whistleblower  procedure, the program continues to be implemented by ISCD under the  existing regulatory framework. For more information about the CFATS  regulation and process, see appendix II.
According to the CFATS Act of 2014, among other things, DHS is to  implement the following six provisions related to a whistleblower  procedure:  1.  not later than 180 days after the date of enactment of the CFATS Act  of 2014, establish and provide information to the public regarding a  procedure under which any employee or contractor of a chemical  facility of interest may submit a report of a CFATS violation,  2.  keep confidential the identity of an employee or contractor at a  chemical facility of interest, who submits a report of a potential CFATS  violation under the established whistleblower procedure,  3.  promptly respond to an employee or contractor at a chemical facility of  interest, who provides contact information, to acknowledge receipt of  the report,  4.  review and consider the information provided in any report submitted,  and take action, as appropriate, to address any substantiated CFATS  violation,  5.  follow certain procedural requirements if the Secretary determines  that a violation has occurred and decides to institute a civil  enforcement or issue an emergency order against a chemical facility,  as appropriate under the law, and  6.  work in partnership with industry associations and labor organizations  to make publicly available, physically and online, the rights that an  individual who provides DHS with whistleblower information about a  covered chemical facility, would have under federal law.
In addition, the CFATS Act of 2014 provides that an owner or operator of  a chemical facility of interest may not discharge or otherwise discriminate  against an employee or contractor because of submitting a report to DHS  of a CFATS violation.
According to DHS officials, to meet the definition of a whistleblower report  under the CFATS Act of 2014, the report must be from an employee or  contractor at a chemical facility of interest and involve a potential CFATS  violation. A CFATS violation is when officials at a chemical facility of  interest violate a provision of the CFATS Act of 2014 or CFATS  regulations, such as knowingly submitting false information to DHS or  failing to maintain appropriate records.
section_title: DHS Received 105 Reports and Closed 97 Because They Did Not Involve CFATS Regulatory Requirements
paragraphs: From June 16, 2015 (when ISCD implemented its whistleblower process)  to April 19, 2016, ISCD received 105 reports from individuals—90 via the  ISCD telephone tip line, 14 via e-mail, and 1 from ISCD’s CFATS help  desk. ISCD officials determined that 8 of the 105 reports were potential  CFATS violations and, after further review, that 1 of the 8 reports involved  a CFATS violation. For the report that ISCD determined was a CFATS  violation, ISCD took action against the chemical facility by requiring it to  register with ISCD pursuant to requirements of the CFATS program.
subsections: section_title: DHS Closed the Vast Majority of Reports Because They Did Not Involve CFATS Regulatory Requirements
paragraphs: ISCD officials determined that 97 of the 105 reports were not potential  CFATS violations and closed the reports because they did not pertain to  requirements under the CFATS program. The most common types of  reports that ISCD officials determined were not potential CFATS  violations involved allegations of suspicious or illegal activity not related to  CFATS. Additionally, the majority of the reports were submitted by  concerned individuals, not employees or contractors at chemical facilities;  therefore, the individuals were not whistleblowers as defined by DHS.  However, ISCD officials also review and address reports from individuals  who are outside of the statutory definition. ISCD officials referred 70 of  the 97 reports (72 percent) to other federal agencies or departments  consistent with ISCD’s interim process for addressing reports, which  states that certain reports are to be referred to other agencies or  departments. For example, reports related to terrorism are to be referred  to the Federal Bureau of Investigation (FBI) Washington Field Office, and  reports related to environmental or community safety are to be referred to  the EPA. Of the 70 reports that ISCD referred to other federal agencies or  departments, 63 reports (90 percent) related to terrorism and other  allegations of criminal activity were referred to the FBI. Figure 1 illustrates  the number and percentage of reports that ISCD received from June 16,  2015 through April 19, 2016, and the disposition for the 97 reports that  ISCD officials determined did not involve potential CFATS violations.
In addition to the 105 reports that ISCD received from June 16, 2015 to  April 19, 2016, ISCD received 345 calls from February 2009—when ISCD  created its telephone tip line for potential CFATS violations—to June 15,  2015 (the day before ISCD implemented its interim process for  addressing CFATS whistleblower reports). See appendix III for our  analysis of the 345 calls.
section_title: DHS Further Reviewed Eight Reports Determined to Involve Potential CFATS Violations and Ultimately Determined That One Report Involved a CFATS Violation
paragraphs: Of the 105 reports, ISCD further reviewed 8 reports (8 percent) that  officials determined to involve potential CFATS violations. ISCD officials  determined that, for one of the eight reports, the chemical facility met  threshold requirements for COI and, therefore, the chemical facility had  violated CFATS for failure to submit required CFATS documentation to  ISCD. Specifically, a concerned individual, who was not an employee or  contractor of a chemical facility, submitted a report about a commercial  propane facility near a residential area. The individual cited concerns  about the facility’s lack of security and expressed fear of a catastrophic  event if the facility was not in compliance with DHS’s security regulations.  ISCD followed-up with the individual to obtain more information and  contacted the facility to obtain information about the quantity of COI at the  facility. ISCD determined that a CFATS violation had occurred because  the facility met the threshold reporting requirements, but had not  registered with ISCD. In addition, ISCD determined that the company had  seven other facilities that should have registered with ISCD. ISCD closed  the report without pursuing civil enforcement action because the facility  submitted required CFATS documentation after ISCD directed the facility  to do so. ISCD determined that six of the eight reports were not CFATS  violations because the chemical facilities or issues reported were not  subject to CFATS regulations. For example, for four reports, ISCD found  that the facilities did not have sufficient quantities of COI to meet  threshold regulatory requirements. The remaining report is still open  because ISCD officials have not completed their investigation. Table 1  describes the eight reports that ISCD further reviewed to determine  whether they were CFATS violations.
section_title: ISCD Has Implemented an Interim Process for Whistleblower Reports but Not for Retaliation Reports, and Guidance for Whistleblowers Is Limited
subsections: section_title: ISCD Developed and Implemented a Documented, Interim Process to Address Whistleblower Reports
paragraphs: In response to the CFATS Act of 2014, ISCD developed a documented,  interim process to address reports of potential CFATS violations, and  implemented the process on June 16, 2015. Figure 2 illustrates the  process and its key procedures.
Our analyses of ISCD’s efforts related to implementing a whistleblower  procedure show that, since June 16, 2015, ISCD has had an interim  process and procedures for all six related provisions for DHS in the  CFATS Act of 2014. Our analyses also show that ISCD has implemented  its interim process and procedures for five of the six provisions. ISCD  officials stated that there has not been a need to implement the remaining  provision—to follow certain procedural requirements if the Secretary  determines that a violation has occurred and decides to institute a civil  enforcement or issue an emergency order. Specifically, from June 16,  2015 to April 19, 2016, there was one whistleblower report that they  substantiated, but it did not result in a civil enforcement or emergency  order because the chemical facility took the action that ISCD required.  Table 2 lists the results of our assessment of ISCD’s efforts since June  16, 2015 to develop and implement a whistleblower process and  procedures for the six related provisions for DHS in the CFATS Act of  2014. For a more detailed description of ISCD’s efforts to develop and  implement a whistleblower process and procedures, see appendix IV.
Regarding ISCD’s specific efforts to implement the five provisions, ISCD  officials told us that, for two provisions, they maintained the confidentiality  of each individual’s identity, and worked in partnership with industry  associations and labor organizations to make publicly available the rights  that an individual, who provides whistleblower information about a  covered chemical facility, would have under federal law. Based on our  analysis of ISCD’s documentation for reports from individuals who  provided their contact information, we did not see any indication that  ISCD breached individuals’ confidentiality. We interviewed officials in the  three industry associations and three labor organizations, who ISCD  officials reached out to, and the industry and labor officials stated that  ISCD officials worked in partnership with them to publicize whistleblower  protections and rights. In addition, our analyses indicate that ISCD  implemented the other three provisions by implementing its interim  process and procedures for addressing whistleblower reports, providing  acknowledgment receipts to individuals, who provided their contact  information and submitted reports that DHS determined to involve  potential CFATS violations, and reviewing and considering the  information provided in the reports.
ISCD officials stated that they are developing formal standard operating  procedures to address reports of potential CFATS violations and the  formal procedures were expected to be implemented by the end of June  2016. The formal procedures will supersede the interim procedures.
section_title: DHS Has Not Developed a Documented Process and Procedures for Addressing Whistleblower Retaliation Reports
paragraphs: The CFATS Act of 2014 prohibits retaliation against whistleblowers, but  DHS lacks a process and procedures to address whistleblower retaliation  reports, according to DHS officials. Specifically, an owner or operator of a  chemical facility of interest or agent may not discharge an employee or  otherwise discriminate against an employee with respect to the  compensation provided to, or terms, conditions, or privileges of the  employment of, the employee, for reporting a potential CFATS violation to  DHS. DHS officials stated that DHS has authority under the CFATS Act of  2014 to issue an administrative order against a chemical facility of interest  that violates the act, including for retaliating against a whistleblower. If  chemical facility officials do not comply with the order, DHS has authority  to issue a civil penalty of up to $25,000 for each day the facility is not in  compliance.
As of April 2016, DHS did not have documented procedures to investigate  whether whistleblower retaliation had occurred, according to DHS  officials. DHS has not received a whistleblower retaliation report that it  substantiated since ISCD implemented the interim process for  whistleblower reports on June 16, 2015. ISCD officials said they do not  plan to include a process and procedures to investigate future retaliation  reports in the formal, standard operating procedures for addressing  whistleblower reports, which were expected to be implemented by the  end of June 2016. However, DHS officials stated that a process to  address retaliation reports would be useful and that DHS intends to  conduct rulemaking to develop a formal process and procedures. The  officials stated that, in the meantime, they would address any future  retaliation reports on a case-by-case basis.
Vetting future retaliation reports on a case-by-case basis may not provide  adequate assurance that ISCD can effectively and efficiently investigate  and respond to reports of retaliation. Standards for Internal Control in the  Federal Government states that management should document the  responsibilities of the organization in policies, so that personnel can carry  out control activities for their assigned responsibilities. Without a  documented process and procedures for investigating and responding to  whistleblower retaliation reports, ISCD officials risk making ad hoc  decisions that may not help ensure consistent and appropriate use of  ISCD’s authority to issue administrative orders and penalties against the  chemical facility.
DHS officials stated that, during 2015, they met with officials in the  Department of Labor’s Occupational Safety and Health Administration  (OSHA), Environmental Protection Agency (EPA), and Nuclear  Regulatory Commission to discuss and learn about, among other things,  the three agencies’ procedures to address whistleblower retaliation  reports and mechanisms to enforce protections against whistleblower  retaliation. OSHA officials told us that they provided DHS officials with an  overview of the process that OSHA uses in its program to protect  whistleblowers from retaliation. DHS officials stated that they are  considering what they learned from OSHA, EPA, and the Nuclear  Regulatory Commission as DHS matures its CFATS whistleblower  process, including how to address any future whistleblower retaliation  reports. Although it is not yet available for DHS to use, OSHA has  developed draft guidance with recommended practices for public, private,  and non-profit employers to use in preventing and addressing  whistleblower retaliation, which OSHA expects to publish in fall 2016.  While the guidance is intended for employers, it could be useful for  consideration when developing a whistleblower retaliation function within  a regulatory program such as CFATS. The practices are based on  recommendations unanimously agreed upon by the Secretary of Labor’s  Whistleblower Protection Advisory Committee. OSHA’s recommended  practices include five steps for creating an effective anti-retaliation  program: (1) ensure leadership commitment, (2) foster an anti-retaliation  culture, (3) implement a system to respond to reports of retaliation, (4)  conduct anti-retaliation training, and (5) monitor progress and program  improvement. To implement a system to respond to reports of retaliation,  the OSHA draft guidance recommends, among other things, using an  objective, independent report review process, focusing on the facts and  underlying concern rather than on defending against the claim, and  listening to all sides before making a judgment. Leveraging recommended  practices, such as those to be published by OSHA, could help ISCD  officials take advantage of lessons learned by other whistleblower  program managers. However, until DHS establishes a documented  process and procedures that could include what was learned from these  other agencies, DHS officials will have an ad hoc process for investigating  retaliation.
section_title: Guidance on the ISCD Telephone Tip Line and Website for Whistleblower Reports Is Insufficient for Gathering Adequate Information from Whistleblowers
paragraphs: The ISCD current telephone tip line greeting and ISCD website for  CFATS whistleblower reports provide no guidance and limited guidance,  respectively, to whistleblowers regarding the types of information that  would be most useful to ISCD in vetting and determining next steps for  the reports. ISCD received almost all of the reports of potential CFATS  violations via its telephone tip line and e-mail address, which are included  on the ISCD website for CFATS whistleblower reports. In the automated  greeting played when a whistleblower calls the telephone tip line to  submit a verbal report, as described in the transcription of the greeting  below, there is no specific guidance given to the whistleblower about the  types of information to provide in the report.
Thank you for calling the CFATS Chemical Facility Security Tip line. If  you would like to report a possible security concern involving the  Chemical Facility Anti-Terrorism Standards (CFATS) regulation at  your facility or another facility, you may do so by leaving a message  after the tone. You are welcome to report these concerns  anonymously, or, if you would like a return call, please leave your  name and number.
If you are calling to report a potential security incident that has already  occurred, please call the National Infrastructure Coordination Center  at 202-282-9201. If you have a security emergency or terrorist  incident, please hang up and call the FBI or 911 immediately. If you  have questions about CFATS generally, please call 866-323-2957.
The ISCD website states the following with regard to the types of  information that a whistleblower should provide.
For anonymous reports, please provide a detailed description of the  nature of the potential violation, including, where possible, names and  dates.
ISCD officials stated that there are no current plans to add guidance to  the telephone tip line greeting and on the website about the types of  information that would be most helpful to ISCD; however, the officials said  that adding guidance would be helpful.
Our analysis of 105 reports received by ISCD from June 16, 2015 to April  19, 2016 identified the following challenges that ISCD officials  experienced in vetting reports due to insufficient information.
Of the 105 reports, ISCD identified 8 reports as potential CFATS  violations. One of the eight reports did not include the name or  location of the chemical facility. ISCD officials told us that the name  and location of the chemical facility are two of the most important  pieces of information in vetting a report that ISCD determines to be a  potential CFATS violation. ISCD officials followed up with the  individual to obtain the location of the chemical facility and information  about the owner/operator of the facility. The individual provided ISCD  with the address and owner of the chemical facility. ISCD used this  additional information to further review the report and determined that  a CFATS violation had occurred. Without this additional information,  ISCD officials would not have had sufficient information to determine  whether a CFATS violation occurred, and would have missed the  opportunity to appropriately address the report and take action against  the facility for CFATS non-compliance.
Of the 105 reports, 62 were submitted from individuals who provided  their contact information. ISCD officials followed up on 13 of the 62  reports (about 21 percent) to obtain additional information to help  ISCD officials determine whether the reports were potential CFATS  violations. Nine of the 13 individuals responded to ISCD’s request for  additional information. However, ISCD officials were unable to reach  the remaining four individuals to obtain needed information and,  consequently, closed the reports without being able to determine if  they involved potential CFATS violations.
Of the 105 reports, 43 were submitted from anonymous individuals  who did not provide contact information. ISCD officials stated that they  were unable to determine if a CFATS violation had occurred for some  reports from anonymous individuals due to insufficient information.
Standards for Internal Control in the Federal Government calls for  agencies to identify the information requirements needed and  communicate these needs internally and externally to achieve the entity’s  objectives. Additional guidance on the ISCD telephone tip line and ISCD  whistleblower website could help ensure that individuals who submit  reports are aware of the types of information to include in the report and,  thus, reduce the amount of ISCD follow-up with individuals due to  insufficient information and enhance information available to ISCD  officials for determining if CFATS violations occurred. Furthermore,  providing additional guidance to whistleblowers about the types of  information most needed by ISCD could help to decrease the number of  reports that ISCD closes without being able to determine whether CFATS  violations occurred.
section_title: Conclusions
paragraphs: The CFATS Act of 2014 required a procedure for whistleblowers to  submit reports about potential CFATS violations at chemical facilities,  including prohibiting retaliation against whistleblowers. However, DHS  has not developed a documented process and procedures to investigate  whether retaliation has occurred. A documented process and procedures  for addressing and investigating whistleblower retaliation reports would  better ensure that DHS can effectively and efficiently investigate reports  to determine whether whistleblowers were retaliated against.
DHS has limited guidance on its whistleblower website and no guidance  on its telephone tip line greeting regarding the types of information that  DHS needs from individuals who submit reports of potential CFATS  violations. Without providing additional guidance to individuals, DHS  officials may miss opportunities to obtain the information needed to  determine if CFATS violations occurred or to do so without conducting  follow-up efforts. This specific guidance will help assist DHS in collecting  the information needed to properly investigate whistleblower reports and  make informed decisions about whether CFATS violations have occurred.
section_title: Recommendations for Executive Action
paragraphs: To help ensure that whistleblower retaliation reports are addressed  efficiently and effectively, we recommend that the Secretary of Homeland  Security direct the Under Secretary of NPPD, the Assistant Secretary for  Infrastructure Protection, and the Director of ISCD to develop a  documented process and procedures to address and investigate  whistleblower retaliation reports that could include existing practices, such  as OSHA’s recommended practices, in developing the process and  procedures.
To assist DHS in collecting the information needed to investigate  whistleblower reports and make informed decisions, we recommend that  the Secretary of Homeland Security direct the Under Secretary of NPPD,  the Assistant Secretary for Infrastructure Protection, and the Director of  ISCD to provide additional guidance on the ISCD whistleblower website  and telephone tip line greeting to clearly communicate the information  needed in the reports.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this report to DHS and relevant excerpts of this  report to the Department of Labor/OSHA, EPA, and the U.S. Nuclear  Regulatory Commission for their review and comment. DHS provided  written comments, which are reproduced in full in appendix V. DHS also  provided technical comments on our draft report and the Department of  Labor/OSHA provided technical comments on the relevant excerpts of our  draft report, which we incorporated as appropriate. The EPA and U.S.  Nuclear Regulatory Commission did not have comments on the relevant  excerpts of our draft report.
DHS concurred with both of our recommendations and described actions  planned to address them. Regarding our recommendation that DHS  develop a documented process and procedures to address and  investigate whistleblower retaliation reports that could include existing  practices, such as OSHA’s recommended practices, DHS stated that due  to the construction of the CFATS-authorizing legislation, developing  formal processes and procedures for investigating whistleblower  retaliation reports will require modifications to the CFATS regulations.  According to DHS, rulemaking typically involves multiple steps over a  considerable length of time and developing a thorough whistleblower  retaliation investigation process and procedures will likely take a number  of years. DHS noted that the OSHA guidance with recommended  practices for addressing whistleblower retaliation complaints is not yet  final, so establishing a formal whistleblower retaliation investigation  process prior to the publication of OSHA’s guidance on the subject may  be premature. However, DHS stated that while awaiting finalized  guidance from OSHA, NPPD’s ISCD will begin moving forward to initiate  the whistleblower retaliation-related rulemaking activities, and develop an  interim process and procedures that will enable the department to  consistently handle any whistleblower retaliation complaints received  during the rulemaking process. These actions, if fully implemented,  should address the intent of the recommendation.
For our recommendation that DHS provide additional guidance on the  ISCD whistleblower website and telephone tip line greeting, DHS stated  that providing additional guidance to potential whistleblowers regarding  the types of information most useful in assessing a potential CFATS  violation is likely to increase the quality of the reports received, and  enable a more efficient and effective evaluation and investigation of them.  DHS also stated that ISCD will update the automated greeting on the  CFATS tip line and the ISCD webpage with additional guidance and  instructions for potential whistleblowers. These actions, if fully  implemented, should address the intent of the recommendation.
We are sending copies of this report to interested congressional  committees and the Secretaries of Homeland Security and Labor, as well  as the Administrator of EPA and the Executive Director for Operations for  the U.S. Nuclear Regulatory Commission. In addition, the report is  available at no charge on the GAO website at http://www.gao.gov.
If you or your staff have any questions about this report, please contact  me at (404) 679-1875 or CurrieC@gao.gov. Contact points for our Offices  of Congressional Relations and Public Affairs may be found on the last  page of this report. Key contributors to this report are listed in appendix  VI.
section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: Our objectives were to determine (1) the number and types of Chemical  Facility Anti-Terrorism Standards (CFATS) whistleblower reports the  Department of Homeland Security (DHS) received, and any actions DHS  took as a result of the reports, and (2) the extent to which DHS has  implemented and followed a process to address reports from the  whistleblowers, including reports of retaliation against whistleblowers.
To determine the number and types of reports that DHS received, and  any actions DHS took as a result of the reports, we reviewed all reports  that DHS’s Infrastructure Security Compliance Division (ISCD) received  from June 16, 2015 to April 19, 2016. Specifically, we reviewed the  content of the 105 reports that ISCD received on the telephone tip line  and by e-mail to identify the types of issues reported. We also interviewed  ISCD officials, who were responsible for vetting and deciding what to do  with these reports, about any actions taken to address the reports. In  addition, we reviewed documentation from ISCD, such as the electronic  spreadsheet for recording and tracking the reports, and documentation  between the individuals who submitted the reports and ISCD, to evaluate  ISCD’s actions from initial receipt of the reports to determining whether or  not CFATS violations had occurred. We assessed the reliability of the  data for the reports by, for example, reviewing ISCD’s standard operating  procedures for receiving and documenting CFATS reports received on  the telephone tip line and by e-mail, and interviewing knowledgeable  officials to identify internal controls to ensure the completeness and  accuracy of the information in the electronic spreadsheet. We determined  the data to be sufficiently reliable for purposes of determining the number  and types of reports received by ISCD.
Although we focused on analyzing reports that DHS received since June  16, 2015, for context, we reviewed the CFATS telephone tip line calls that  ISCD received from February 2009, when the telephone tip line started, to  June 15, 2015—the day prior to ISCD’s implementation of the  whistleblower procedure required under the Protecting and Securing  Chemical Facilities from Terrorist Attacks Act of 2014 (CFATS Act of  2014). We analyzed the tip line calls to identify the types of issues  reported and any DHS actions to address the calls. Specifically, we  reviewed the transcriptions for 345 telephone tip line calls received and  analyzed the content of the calls to identify those that may have been  related to a potential CFATS violation, and to summarize the types of  issues reported. We identified the key characteristics of the calls and  categorized them as either not related to a CFATS violation or involving a  potential CFATS violation. For those categorized as involving a potential  CFATS violation, we categorized them into two sub-categories—either  they potentially involved CFATS non-compliance, or they involved  suspicious or illegal activity related to a chemical facility. Our analysis  was limited to the content of the transcribed calls. ISCD has limited  documentation on actions taken to address the calls received prior to  June 16, 2015. Therefore, we were unable to review ISCD’s decisions on  these calls, and our analysis does not include actions taken or decisions  made by ISCD. However, our analysis is intended to provide perspective  on the extent to which the calls were CFATS related and some examples  of the types of issues that were reported to DHS prior to the  implementation of the whistleblower process in response to the mandate  in the CFATS Act of 2014. We assessed the reliability of the data for the  calls by, for example, reviewing ISCD’s standard operating procedures for  receiving and documenting CFATS tip line calls and interviewing  knowledgeable officials and reviewing guidance to understand how the  calls are received and transcribed. We determined the data to be  sufficiently reliable for purposes of determining the number of calls  received by ISCD and the types of issues reported.
To determine the extent to which DHS implemented and followed a  process to address reports from CFATS whistleblowers, we reviewed the  CFATS Act of 2014, the Infrastructure Security Compliance Division  Interim Process for Addressing Reports of Potential Chemical Facility  Anti-Terrorism Standards (CFATS) Violations, and ISCD’s spreadsheet  which documents ISCD officials’ review, actions taken, and decisions  about each CFATS report received since June 16, 2015, when ISCD  implemented its interim process. We also reviewed ISCD’s guidance for  submitting a whistleblower report on ISCD’s telephone tip line and CFATS  whistleblower website. We identified provisions related to whistleblower  protections in the CFATS Act of 2014, and analyzed ISCD’s interim  process for addressing reports of potential CFATS violations to determine  if ISCD has a process and procedures for each applicable provision in the  CFATS Act of 2014, and implemented its process and procedures since  June 16, 2015 for each applicable provision in the CFATS Act of 2014.
We interviewed DHS officials responsible for vetting and making  decisions about reports received from June 16, 2015 to April 19, 2016  (the date of ISCD’s last data update to us). To better understand DHS’s  process for addressing these reports, we reviewed the electronic tracking  spreadsheet that ISCD officials use to document the reports, including  actions taken to address them and the disposition of the reports. We used  this information to evaluate ISCD’s efforts to implement the process and  procedures to address each provision of the CFATS Act of 2014,  including, for example, acknowledging receipt of the report and informing  individuals of their whistleblower rights. We also analyzed information and  interviewed DHS officials about factors that could affect how reports were  addressed, such as the process for addressing reports received from  individuals who did not meet DHS’s definition of a whistleblower, and  reports that did not involve CFATS violations, as well whether there were  any reports of retaliation against whistleblowers and how DHS would  process such reports. In addition, we interviewed the lead official for  ISCD’s telephone tip line and analyzed documents for the tip line at Oak  Ridge National Laboratory in Tennessee about the process used to  receive calls, transcribe them, and e-mail them to ISCD headquarters  since February 2009.
We compared ISCD’s interim process against Standards for Internal  Control in the Federal Government to identify the extent to which DHS’s  process was in alignment with these standards. In addition, to identify  practices that are used to address whistleblower reports and reports of  retaliation in comparable federal settings, we interviewed officials who  DHS had consulted with at the Department of Labor’s Occupational  Safety and Health Administration (OSHA), Nuclear Regulatory  Commission, and Environmental Protection Agency, and analyzed related  documents, including OSHA’s draft paper on recommended practices for  employers for preventing and addressing retaliation. To determine if  DHS worked in partnership with industry associations and labor  organizations to inform them of ISCD’s whistleblower process and related  whistleblower rights under federal law, and to obtain industry and labor  perspectives on ISCD’s interim process for addressing reports of potential  CFATS violations, we interviewed officials from ISCD and all six industry  associations and labor organizations that ISCD officials told us they met  with. The industry associations were three sector coordinating councils— Chemical, Food and Agriculture, and Oil and Natural Gas. The labor  organizations were the International Brotherhood of Teamsters,  International Chemical Workers Union Council, and United Steelworkers  Union. The information we gathered from these six organizations is not  generalizable, but provides perspectives on ISCD’s coordination with  them regarding ISCD’s whistleblower process.
We conducted this performance audit from September 2015 to July 2016  in accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
section_title: Appendix II: The Chemical Facility Anti- Terrorism Standards Regulation and Process
paragraphs: The Chemical Facility Anti-Terrorism Standards (CFATS) regulation and  the Protecting and Securing Chemical Facilities from Terrorist Attacks Act  of 2014 (CFATS Act of 2014) outline how the Department of Homeland  Security’s (DHS) Infrastructure Security Compliance Division (ISCD) is to  administer the CFATS program. Specifically, any facility that possesses  any of the 322 chemicals of interest (COI) in quantities that meet or  exceed the screening threshold quantities established by DHS for those  COI are required to use ISCD’s Chemical Security Assessment Tool  (CSAT)—a web-based application through which owners and operators of  facilities with COI are to provide information about the facility—to  complete a Top-Screen. The Top-Screen is the initial screening tool  whereby a chemical facility in possession of a COI at the requisite  thresholds is to provide ISCD data, including the name and location of the  facility and the COI and their quantities at the site.
ISCD’s risk assessment approach, which relies on data from the Top- Screen, among other sources, is based on three security issues: (1)  release (toxic, flammable, and explosive) chemicals with the potential for  impacts within and beyond a facility; (2) theft or diversion; and (3)  sabotage, depending on the type of risk associated with the COI.
Release: For the release threat, ISCD’s approach assumes that a  terrorist will release the COI at the facility and then estimates the  risk to the facility and surrounding population. Facilities with toxic  release chemicals are to calculate and report in their Top-Screen  submission the Distance of Concern—which represents the radius  of an area in which exposure to a toxic chemical cloud from a  release event could cause serious injury or fatalities from short- term exposure. ISCD uses the Distance of Concern to estimate  the number of fatalities from an intentional toxic release and to  categorize the risk posed by this facility. The Top-Screen directs  respondents to use an online tool called RMP*Comp to calculate  the Distance of Concern. RMP*Comp takes inputs such as the  quantity of chemical that could be released and the surrounding  terrain type to determine the Distance of Concern.
Theft or diversion: For theft or diversion, the approach assumes  that a terrorist will steal or have the COI diverted to him or herself  and then estimates the risk of a terrorist attack using the COI to  cause the most harm at an unspecified off-site location.
Sabotage: For sabotage, the approach assumes that a terrorist  will cause water to be mixed with a COI that is shipped from the  facility, creating a toxic release at an unspecified location, and  then estimates the risk to a medium-sized U.S. city.
If, according to ISCD’s automated assessment of information provided via  the Top-Screen, the facility is preliminarily categorized to be high-risk it  becomes a “covered chemical facility,” and ISCD is to notify the facility of  its preliminary placement in one of four risk-based tiers—tier 1, 2, 3, or 4.  If ISCD does not categorize the chemical facility as high-risk, ISCD does  not assign the facility to one of these four risk-based tiers and the facility  is not subject to additional requirements under the CFATS regulation.  Facilities that ISCD preliminarily categorizes to be high-risk—covered  chemical facilities—are required to then complete the CSAT security  vulnerability assessment, which includes the identification of potential  critical assets at the facility, and a related vulnerability analysis. ISCD is  to review the security vulnerability assessment to confirm and notify the  facility as to whether the facility remains categorized as high-risk and, if  so, about its final placement in one of the four tiers.
Once a covered chemical facility is assigned a final tier, the facility may  use CSAT to submit a site security plan (SSP) or submit an Alternative  Security Program in lieu of the CSAT SSP. The security plan is to  describe the existing and planned security measures to be implemented  to address the vulnerabilities identified in the security vulnerability  assessment, and identify and describe how existing and planned security  measures selected by the facility are to address the applicable risk-based  performance standards. To meet risk-based performance standards,  covered facilities may choose the security programs or processes they  deem appropriate to address the performance standards so long as ISCD  determines that the facilities achieve the requisite level of performance on  each of the applicable areas in their existing and agreed-upon planned  measures.
To determine whether facilities achieve the requisite level of performance  for each of the applicable areas, ISCD is to conduct a preliminary review  of the facility’s security plan to determine whether it meets the risk-based  regulatory requirements. If these requirements appear to be satisfied,  ISCD is to issue a letter of authorization for the plan, and conduct an  authorization inspection of the facility to determine whether to approve the  plan. Upon inspection of the facility, if ISCD determines that the plan  satisfies the CFATS requirements, it will issue a letter of approval to the  facility, which is to then implement the approved SSP. If ISCD determines  that the plan does not satisfy CFATS requirements, ISCD then notifies the  facility of any deficiencies and the facility must submit a revised plan for  correcting them.
Following ISCD’s approval of a facility’s SSP, in order to assess  compliance with CFATS requirements as addressed through the  approved SSP, ISCD conducts a compliance inspection (CI) of the  covered facilities. CIs are to follow specific standard operating  procedures that focus on verifying existing measures and the  implementation and effectiveness of planned measures, including dates  implemented, as well as verifying and reviewing any significant changes  in the facility’s security posture. If through a compliance inspection it is  determined a facility has not fully implemented security measures as  outlined in its approved site security plan, ISCD is to provide the facility  with written notification that clearly identifies the deficiencies in the SSP  and will work with the facility toward achieving full compliance or, if  warranted, take enforcement action. For example, the CFATS regulation  provides that an order compelling a facility to take appropriate action may  be issued if the facility was found to be in violation of any part of the  regulation. If a facility were to violate this initial order, an order assessing  a civil penalty of up to $25,000 per day or to cease operations, or both,  may be issued. According to ISCD guidance, inspectors conducting a CI  are to document in a CI report any necessary enforcement actions that  may result from the inspection, including, among others, security  measures not implemented in accordance with the SSP. ISCD guidance  further provides that inspectors are not to recommend enforcement  actions where issues identified during a CI are quickly remedied on-site;  however, inspectors are to document their finding in the CI report.  Inspection teams are to submit their CI report to ISCD management for  review and approval within 25 business days from the inspection  completion. ISCD management is to then determine whether a facility is  in compliance with their approved SSP or whether to take enforcement  actions. Figure 3 illustrates the CFATS regulatory process.
section_title: Appendix III: Analysis of Calls Received by the Department of Homeland Security’s Infrastructure Security Compliance Division from February 2009 to June 15, 2015
paragraphs: In February 2009, the Department of Homeland Security’s (DHS)  Infrastructure Security Compliance Division (ISCD) began receiving calls  related to Chemical Facility Anti-Terrorism Standards (CFATS) via a  telephone tip line that ISCD established. ISCD received 345 calls via the  telephone tip line from February 2009 to June 15, 2015, the day before  ISCD implemented its whistleblower process for addressing CFATS  reports in response to the Protecting and Securing Chemical Facilities  from Terrorist Attacks Act of 2014 (CFATS Act of 2014). DHS officials  stated that there was no requirement for DHS to address CFATS  whistleblower reports prior to the act. Starting on June 16, 2015, ISCD  implemented a whistleblower process and procedures for addressing  CFATS reports, including those received via its telephone tip line, and  began to collect and track information for each report in an electronic  spreadsheet.
Of the 345 calls that ISCD received before implementing the interim  process for addressing whistleblower reports, we identified 46 calls (13  percent) that may have involved potential CFATS violations. ISCD  officials stated that, at the time they received and vetted the calls, they  determined that none of the 345 calls involved CFATS violations. We  were not able to reconcile the differences between our determinations  and ISCD’s determinations because ISCD officials said they did not  consistently document their reviews of the calls, any actions taken, or  decisions. Also, our analysis was limited to the transcriptions of each tip  line call and did not include any additional documentation. Therefore, our  analysis is not intended to assess ISCD’s performance in addressing  these reports, but to provide perspective on the types of calls that ISCD  received prior to implementing the interim process for addressing reports  of potential CFATS violations. Table 3 shows our analysis of the 345 calls  that ISCD received via its telephone tip line from February 2009 to June  15, 2015.
Table 4 shows the 46 calls that we determined may have involved  potential CFATS violations during fiscal years 2009 to 2015 by type of  call, based on the information contained in the calls.
To provide further insight into the types of calls that ISCD received via the  telephone tip line from February 2009 to June 2015, table 5 describes six  examples of the calls—three that we determined were not related to  CFATS and three that we determined may have involved potential  CFATS violations, based on the information contained in the calls.
section_title: Appendix IV: Summary of the Department of Homeland Security’s Efforts to Develop and Implement a Process and Procedures for Whistleblower Reports Related to Chemical Facility Anti-Terrorism Standards
paragraphs: The Department of Homeland Security’s (DHS) Infrastructure Security  Compliance Division (ISCD) developed a process and procedures to  address reports of potential violations of Chemical Facility Anti-Terrorism  Standards (CFATS). The process and procedures were implemented on  June 16, 2015. Table 6 describes ISCD’s efforts to develop and  implement the process and procedures for the provisions related to a  whistleblower procedure in the Protecting and Securing Chemical  Facilities from Terrorist Attacks Act of 2014 (CFATS Act of 2014).
section_title: Appendix V: Comments from the Department of Homeland Security
section_title: Appendix VI: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, Ben Atwater, Assistant Director,  and Joseph E. Dewechter, Analyst-in-Charge, managed this audit  engagement. Michele Fejfar, Eric Hauswirth, Tracey King, Natalie  Maddox, and Tovah Rom made significant contributions to this report.