Homeland Security: Voluntary Initiatives Are Under Way at Chemical Facilities, but the Extent of Security Preparedness Is Unknown
Published: 2003-03-14T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The events of September 11, 2001, triggered a national re-examination of the security of thousands of industrial facilities that use or store hazardous chemicals in quantities that could potentially put large numbers of Americans at risk of serious injury or death in the event of a terrorist-caused chemical release. GAO was asked to examine (1) available information on the threats and risks from terrorism faced by U.S. chemical facilities; (2) federal requirements for security preparedness and safety at facilities; (3) actions taken by federal agencies to assess the vulnerability of the industry; and (4) voluntary actions the chemical industry has taken to address security preparedness, and the challenges it faces in protecting its assets and operations.
section_title: What GAO Found
paragraphs: Chemical facilities may be attractive targets for terrorists intent on causing economic harm and loss of life. Many facilities exist in populated areas where a chemical release could threaten thousands. EPA reports that 123 chemical facilities located throughout the nation have toxic "worst-case" scenarios where more than a million people in the surrounding area could be at risk of exposure to a cloud of toxic gas if a release occurred. To date, no one has comprehensively assessed the security of chemical facilities. No federal laws explicitly require that chemical facilities assess vulnerabilities or take security actions to safeguard their facilities from attack. However, a number of federal laws impose safety requirements on facilities that may help mitigate the effects of a terrorist-caused chemical release. EPA believes that the Clean Air Act could be interpreted to provide authority to require chemical facilities to assess their vulnerabilities and to make security enhancements that protect against attacks. However, EPA has not attempted to use these Clean Air Act provisions because of concerns that this interpretation would pose significant litigation risk and has concluded that chemical facility security would be more effectively addressed by passage of specific legislation. The federal government has not comprehensively assessed the chemical industry's vulnerabilities to terrorist attacks. EPA, the Department of Homeland Security, and the Department of Justice have taken preliminary steps to assist the industry in its preparedness efforts, but no agency monitors or documents the extent to which chemical facilities have implemented security measures. Consequently, federal, state, and local entities lack comprehensive information on the vulnerabilities facing the industry. To its credit, the chemical industry, led by its industry associations, has undertaken a number of voluntary initiatives to address security at facilities. For example, the American Chemistry Council, whose members own or operate 1,000, or about 7 percent, of the facilities subject to Clean Air Act risk management plan provisions, requires its members to conduct vulnerability assessments and implement security improvements. The industry faces a number of challenges in preparing facilities against attacks, including ensuring that all chemical facilities address security concerns. Despite the industry's voluntary efforts, the extent of security preparedness at U.S. chemical facilities is unknown. Finally, both the Secretary of Homeland Security and the Administrator of EPA have stated that voluntary efforts alone are not sufficient to assure the public of industry's preparedness.

section_title: Letter
paragraphs: As the events of September 11, 2001, showed, terrorists can cause  enormous damage to our country by attacking infrastructure essential to  our economy and jeopardizing public health and safety. Following these  events, the President, in the National Strategy for Homeland Security,  identified 13 sectors as critical to the nation’s infrastructure. One of the  sectors identified—the nation’s $450 billion chemical industry—produces  the chemicals needed to manufacture thousands of products, such as  those used in agriculture, pharmaceuticals, and automobiles. Furthermore,  the federal government has identified 140 toxic and flammable chemicals  that, in certain amounts, would pose the greatest risk to human health and  the environment if they were accidentally released into the air. The  chemical industry is not the only U.S. industry that houses these  hazardous chemicals. Other industries, such as agricultural retailers,  drinking water and wastewater treatment systems, food processors and  distributors who have ammonia refrigeration systems, and petroleum  refineries, also house these chemicals. In all, the federal government  estimates that a total of 15,000 facilities in the United States produce, use,  or store more than threshold amounts of these 140 hazardous chemicals.
Even before September 11, 2001, protecting chemical facilities was the  shared responsibility of federal, state, and local governments in  partnership with the private sector. However, attention was focused  largely on the risks of accidental, rather than intentional, chemical  releases. The Environmental Protection Agency (EPA), under the Clean  Air Act, requires that about 15,000 facilities with more than threshold  amounts of chemicals posing the greatest risk to human health and the  environment take a number of steps to prevent and prepare for an  accidental chemical release. These facilities must develop a risk  management program, which includes an assessment of the off-site  consequences of an accidental chemical release and an accident  prevention program, and an emergency response plan. The events of  September 11, 2001, brought heightened attention to chemical facility  security and the possibility of an intentional terrorist-caused chemical  release.
The federal government’s role in protecting facilities from terrorist attack  has been much debated since September 11, 2001. Debate has focused on  whether the federal government should impose security requirements on  chemical facilities or whether voluntary industry actions are sufficient.  Congress is currently considering several legislative proposals that  address the protection of critical infrastructure, including mandating  security measures at chemical facilities.
As agreed with your offices, we examined a number of issues surrounding  the security of the chemical industry. In this report, we (1) summarize  available information on the threats and risks from terrorism that U.S.  chemical facilities face; (2) describe federal requirements for security  preparedness and the safe management of chemicals at these facilities;   (3) describe actions federal agencies have taken to assess the vulnerability  of the chemical industry or to address security preparedness; and   (4) describe the voluntary actions the chemical industry has taken to  address security preparedness, and the challenges it faces in protecting its  assets and operations. To determine the threats and risks from terrorism  faced by U.S. chemical facilities, we interviewed officials at the  Department of Defense’s Army Office of the Surgeon General and the  Defense Threat Reduction Agency. We also interviewed officials in the  Department of Justice’s (Justice) National Institute of Justice and several  units of the Federal Bureau of Investigation (FBI) including the Hazardous  Materials Response Unit, the National Infrastructure Protection Center,  and the Weapons of Mass Destruction Unit. We interviewed officials at  EPA headquarters, including those from the Chemical Emergency  Preparedness and Prevention Office, and we reviewed risk management  plan (RMP) data. We also collected and reviewed available reports.
To determine the federal requirements for security preparedness and the  safe management of chemicals at these facilities, we interviewed officials  from the Department of Labor’s Occupational Safety and Health  Administration (OSHA) and EPA on safety standards and legal authority.  We reviewed statutes and regulations to determine the relevant statutory  framework. To determine the actions taken by federal agencies to assess  the vulnerability of the chemical industry or to address security  preparedness, we reviewed the National Strategy for Homeland Security  and several Justice reports. We interviewed officials at the Departments of  Energy and Justice, at EPA, and at OSHA. We also attended EPA- sponsored training classes on vulnerability assessments taught by officials  from the Department of Energy’s Sandia National Laboratories. We also  discussed the voluntary actions the chemical industry has taken to address  security preparedness and the challenges it faces in protecting its assets  and operations with these agencies. In addition, we interviewed the U.S.  Chemical Safety and Hazards Investigation Board, the Center for Chemical  Process Safety, and numerous industry associations including the  American Chemistry Council (ACC), the American Petroleum Institute, the  Chlorine Institute, Inc., the Fertilizer Institute, the Gas Processors  Association, the International Institute of Ammonia Refrigeration, the  National Petroleum and Refiners Association, and the Synthetic Organic  Chemical Manufacturers Association. We attended security conferences  held by the ACC and the American Petroleum Institute.
We also interviewed industry officials at a number of facility locations. To  select the facilities for our visits, we used EPA’s RMP database to select  facilities in the highest-risk tier in states with facilities storing the largest  quantities of hazardous chemicals. We selected 27 facilities that  represented various chemical manufacturing industry sectors, such as  industrial gases and plastics and resins. We provided this list of facilities to  the ACC, which then contacted facility officials and identified 8 facilities  willing to host our visits. We visited 6 of these facilities. In addition, we  visited another facility that we contacted independently. We recognize that  there are risks associated with the transportation sector, but it was not  within the scope of our review. We limited our review of security issues to  stationary chemical facilities and did not address security concerns  surrounding the transportation of hazardous chemicals. In October 2002,  we also issued a report on some actions Justice has taken to assess the  chemical industry’s vulnerabilities to terrorist attack.
subsections: section_title: Background
paragraphs: Chemical facilities manufacture a host of products—including basic  organic chemicals, plastic materials and resins, petrochemicals, and  industrial gases, to name a few. Other facilities, such as fertilizer and  pesticide facilities, pulp and paper manufacturers, water facilities, and  refineries, also house large quantities of chemicals.
EPA has a role in preventing and mitigating accidental releases at  chemical facilities through, among other things, the RMP provisions of the  Clean Air Act. Under these provisions, EPA identified 140 toxic and  flammable chemicals that, when present above certain threshold amounts,  would pose the greatest risk to human health and the environment if  released. According to EPA, approximately 15,000 facilities in a variety of  industries produce, use, or store one or more of these chemicals beyond  threshold amounts in one or more processes (e.g., single or interconnected  vessels or tanks).  Table 1 outlines the number and percent of processes in  different industry sectors that maintain more than threshold amounts of  these hazardous chemicals.
In July 2002, the President issued the National Strategy for Homeland  Security, which spells out the activities that must be accomplished or  coordinated to improve the nation’s readiness to address terrorism. The  strategy designated EPA as the lead agency for interacting with the  chemical industry and the hazardous materials sector. Although the  strategy outlines a framework for agencies’ activities by setting forth  overarching goals, the specific roles and responsibilities for achieving  these goals are still being debated. In November 2002, Congress created  the Department of Homeland Security to consolidate many homeland  security activities and coordinate the efforts of federal, state, and local  governments and the private sector.
A number of other critical infrastructures have federal security  requirements. For example, all commercial nuclear power plants licensed  by the Nuclear Regulatory Commission are subject to a number of security  requirements, including placing physical barriers outside the operating  reactor area, limiting access to vital areas, maintaining a trained security  force, and conducting simulated terrorist attack exercises. Congress  passed the Aviation and Transportation Security Act of 2001, which  transferred aviation security from the Federal Aviation Administration to  the newly created Transportation Security Administration and directed the  agency to take over responsibility for airport screening. The Public Health  Security and Bioterrorism Preparedness and Response Act of 2002  requires community water systems serving more than 3,300 people to  conduct a vulnerability assessment to terrorist attacks, prepare an  emergency response plan that incorporates the results of the vulnerability  assessment, certify to EPA that the vulnerability assessment and  emergency response plan have been completed, and provide a copy of the  assessment to EPA. To improve security in our nation’s ports, the  Maritime Transportation Security Act of 2002 directs the Secretary of the  Department of Homeland Security to identify vessels and port facilities  that pose a high risk of being involved in a transportation security incident  and to conduct a vulnerability assessment of these facilities and vessels.
Congress is considering several legislative proposals that would grant EPA  authority to require chemical facilities to take security steps. The 108th  Congress has introduced S. 6 and S. 157 that direct EPA, in consultation  with the Department of Homeland Security, to identify “high-priority”  chemical facilities based on the severity of the threat and require these  facilities to identify hazards; perform vulnerability assessments; and  develop and implement prevention, preparedness, and response plans to  address vulnerabilities and hazards. The facilities would then be required  to send these assessments and plans to EPA. EPA and the Department of  Homeland Security would jointly review the assessments and plans and  certify compliance.
section_title: An Attack Against Chemical Facilities Could Cause Economic Harm and Loss of Life
paragraphs: Experts agree that chemical facilities present an attractive target for  terrorists intent on causing massive damage because many facilities house  toxic chemicals that could become airborne and drift to surrounding areas  if released. Alternatively, terrorists could steal chemicals, which could be  used to create a weapon capable of causing harm. Justice has been  warning of the terrorist threat to chemical facilities for a number of years  and has concluded that the risk of an attempt in the foreseeable future to  cause an industrial chemical release is both real and credible. In fact,  according to Justice, domestic terrorists plotted to use a destructive  device against a U.S. facility that housed millions of gallons of propane in  the late 1990s. In testimony on February 6, 2002, the Director of the  Central Intelligence Agency warned of the potential for an attack by   al Qaeda on chemical facilities.
Some chemical facilities may be at higher risk of a terrorist attack than  others when they contain large amounts of toxic chemicals and are  located near population centers assuming that the objective is a  catastrophic release. Attacks on such facilities could harm a large number  of people, with health effects ranging from mild irritation to death, cause  large-scale evacuations, and disrupt the local or regional economy. No  specific data are available on what the actual effects of successful terrorist  attacks on chemical facilities would be. However, facilities subject to the  RMP provisions submit to EPA estimates of the potential consequences to  surrounding communities of hypothetical accidental “worst-case”  chemical releases from their plants. These estimates include the  residential population located within the range of a toxic gas cloud  produced by a “worst-case” chemical release, called the “vulnerable zone.”  According to EPA, 123 chemical facilities located throughout the nation  have toxic “worst-case” scenarios where more than one million people  would be in the “vulnerable zone” and could be at risk of exposure to a  cloud of toxic gas. About 600 facilities could each potentially threaten  between 100,000 and a million people, and about 2,300 facilities could each  potentially threaten between 10,000 and 100,000 people within these  facilities’ “vulnerable zones.” Figure 1 shows the residential population  within the “vulnerable zone” that could potentially be threatened by an  accidental toxic chemical release from a U.S. facility under a “worst-case”  scenario.
According to EPA, “worst-case” scenarios do not consider the potential  causes of a release or how different causes or other circumstances, such  as safety features, could lessen the consequences of a release.  Hence, the  “worst-case” scenario calculations would be overstating the potential  consequences.  However, the RMP regulation requires facilities to estimate  the effects of a toxic chemical release involving the greatest amount of the  toxic chemical held in a single vessel or pipe—not the entire quantity on  site. Therefore, for some facilities it is conceivable that an attack, where  multiple chemical vessels were breached simultaneously, could result in  an even larger release, involving more severe potential consequences, than  those estimated in the RMP “worst-case” scenarios. Other factors could  also make a facility a more attractive target. For example, a facility that is  widely recognizable, located near a historic or iconic symbol, or critical to  supporting other infrastructures could be at higher risk.
The Army has also estimated high potential damage to the population from  a toxic chemical release. During a 2001 informal meeting with a number of  agencies, the Army Office of The Surgeon General proposed, based on  generic estimates, that it was conceivable that as many as 2.4 million  people could request medical treatment if a terrorist caused a release of a  toxic chemical. According to officials from that office, these estimates  include anyone who seeks medical attention as a result of the release— including people with minor irritations or concerns. Finally, a 2002  Brookings Institution report ranks an attack on toxic chemical plants  behind only biological and atomic attacks in terms of possible fatalities.
Currently, no one has comprehensively assessed security across the nation  at facilities that house chemicals. According to a 1999 study by the Agency  for Toxic Substances and Disease Registry (ATSDR), security at chemical  plants in two communities was fair to very poor. ATSDR observed security  vulnerabilities such as freely accessible chemical barge terminals and  chemical rail cars parked near residential areas in communities where  plants are located. Furthermore, during a limited review of chemical  industry vulnerabilities conducted primarily before September 11, 2001,  Justice found that security at 11 chemical facilities was comparable to  security found at other industrial facilities. According to Justice, some  facilities may need to implement more effective security systems and  develop alternative means to reduce the potential consequences of a  successful attack. The effectiveness of security at some facilities may also  be in doubt as evidenced by several media accounts of reporters and  environmental activists gaining access to chemical tanks and computer  centers that control manufacturing processes at these facilities.
section_title: No Federal Requirements Specifically Require Chemical Facilities to Address the Threat of Terrorism
paragraphs: No federal laws explicitly require that chemical facilities take security  actions to safeguard their facilities against a terrorist attack. A number of  federal laws impose safety requirements applicable to chemical facilities,  but these requirements do not specifically address security preparedness  against terrorism. However, these safety requirements may help mitigate  the effects of such an attack. While no law explicitly requires facilities to  address the threat of terrorism, EPA believes that the Clean Air Act could  be interpreted to provide authority to address site security from terrorist  attack at chemical facilities.  However, EPA has not attempted to use these  Clean Air Act provisions.  EPA is concerned that such an interpretation  would pose significant litigation risk and has concluded that chemical  facility security would be more effectively addressed by passage of  specific legislation.  Currently, EPA is working with chemical industry  groups on voluntary initiatives to increase security at their facilities.
subsections: section_title: Federal Government Does Not Specifically Require Chemical Facilities to Address the Threat of Terrorism, but It Has Requirements Addressing Safety and Emergency Response
paragraphs: While the federal government does not require chemical facilities to take  security measures to protect against a terrorist attack, it does require  certain facilities to take security precautions directed to prevent  trespassing or theft. However, these requirements do not cover a wide  range of chemical facilities and may do little to actually prevent a terrorist  attack. For example, under EPA’s regulations implementing the Resource  Conservation and Recovery Act of 1976, facilities that house hazardous  waste generally must take certain security actions, such as posting  warning signs and using a 24-hour surveillance system or surrounding the  active portion of the facility with a barrier and controlled entry gates.  However, according to EPA, these requirements would be applicable to  only approximately 21 percent of the 15,000 RMP facilities because this   21 percent is also subject to the Resource Conservation and Recovery  Act’s requirements. Moreover, while a facility’s use of a 24-hour  surveillance system or a means to control entry may help impede a  terrorist’s access to a facility, these security measures are aimed at  keeping out trespassers or wanderers, not intentional intruders, according  to EPA.
Several statutes, including the Occupational Safety and Health Act, the  Clean Air Act, and the Emergency Planning and Community Right-to-Know  Act, impose safety and emergency response requirements on chemical  facilities that may incidentally reduce the likelihood and mitigate the  consequences of terrorist attacks. The Occupational Safety and Health  Act imposes a number of safety requirements, including a general duty to  furnish a workplace free from recognized hazards that may cause death or  serious physical harm to employees. The 1990 amendments to the Clean  Air Act also include safety requirements, including a general duty to  prevent and mitigate accidental chemical releases.  Specifically, section  112(r) of the Clean Air Act includes a general duty clause directing owners  and operators of facilities that produce, use, handle, or store listed or  other extremely hazardous substances to identify hazards, design and  maintain a safe facility to prevent releases, and minimize the  consequences of any accidental releases that occur.
Section 112(r) also directs EPA to establish regulations under which  owners and operators of facilities that handle listed (or “regulated”)  extremely hazardous substances over a threshold amount are required to  prepare and implement a risk management plan to detect and prevent or  minimize accidental releases. Facility owners and operators must  conduct a hazard assessment that includes an evaluation of worst-case  accidental release scenarios. They must also implement a program to  prevent accidental releases that includes safety precautions and  maintenance, monitoring, and training measures, and have an emergency  response plan with specific actions to be taken in response to an  accidental release. In addition, these facilities must coordinate their  activities with community emergency response organizations. Facility  owners or operators must generally discuss these activities in an RMP and  submit it to EPA.
The Clean Air Act Amendments of 1990 also call for OSHA to establish a  standard to protect employees from hazards associated with accidental  releases of highly hazardous chemicals in the workplace. OSHA’s process  safety management standard (on which EPA’s RMP regulations are  modeled) requires facilities to assess and address the hazards of their  chemical process.  Implementation of the standard makes facilities safer  and could help mitigate the consequences of a terrorist attack. Regulated  companies in over 95 different industry sectors, including chemical  manufacturing, must conduct hazard evaluations, known as process  hazard analyses, for every step of a covered manufacturing process.  These analyses must include hazards of the process, engineering and  administrative controls applicable to the hazards, facilities siting, and  evaluation of the range of possible health and safety effects of failures of  controls on employees. Based on these analyses, employers must take  action to address the findings. Examples of measures that facilities could  take include storing smaller amounts of chemicals, substituting less  dangerous chemicals for chemicals currently in use, installing automatic  shutdown systems, and installing pipes and other critical equipment that  are stronger and better-shielded.
The Emergency Planning and Community Right-to-Know Act focuses on  understanding hazards and planning for emergencies to ensure that if a  release occurs, local responders will be able to take quick, effective  actions to protect public health and the environment. Under this act,  owners of facilities that maintain specified quantities of certain extremely  hazardous chemicals must submit information annually on their chemical  inventory to state and local emergency response officials. The act also  requires that each state establish a State Emergency Response  Commission to oversee local emergency planning and create local  emergency planning committees. Local emergency planning committee  members include local police, fire fighters, health officials, representatives  from government and media, community groups, and representatives from  facilities. These committees must develop and periodically review their  communities’ emergency response plans, including the identification of  chemical facilities, and outline procedures for response personnel to  follow in the event of a chemical incident.
All of these requirements could potentially mitigate a terrorist attack in a  number of ways. First, because some of these requirements only apply to  facilities with more than threshold quantities of certain chemicals, facility  owners have an incentive to reduce or eliminate these chemicals, which  may make the facility a less attractive target or minimize the impact of an  attack. Second, both the RMP and process safety management hazard  analyses require operators to identify the areas of their plants that are  vulnerable to a chemical release. When facilities implement measures to  improve the safety of these areas, such as installing sensors and  sprinklers, the impact of a terrorist-caused release may be lessened. Third,  the emergency response plans increase preparedness for a chemical  release—whether intentional or unintentional. More coordinated and  immediate emergency response could mitigate the consequences of a  terrorist attack.
In addition to these federal safety requirements, some states and localities  have imposed additional safety requirements on chemical facilities and, in  some instances, have addressed the security of chemical facilities from  terrorism. For example, Contra Costa County, California, in implementing  EPA’s RMP provisions, requires that chemical facilities incorporate  inherently safer technologies. Specifically dealing with the threat of  terrorism, New Jersey has implemented criminal penalties for any toxic  chemical manufacturer who recklessly allows an unauthorized individual  to obtain access to the chemical. In addition, Baltimore, Maryland, passed  a city ordinance addressing the threat of terrorism that requires chemical  manufacturers to follow a set of safety and security regulations devised by  its fire and police commissioners. Companies that fail to comply with the  ordinance may face penalties such as the withholding or suspension of  facility operating permits.
section_title: EPA’s Views of Its Authority to Require Chemical Facilities to Prepare for Terrorist Acts
paragraphs: EPA believes that the Clean Air Act could be interpreted to provide  authority to address site security from terrorist attack at chemical  facilities. However, EPA has not attempted to use these Clean Air Act  provisions. EPA is concerned that such an interpretation would pose  significant litigation risk and has concluded that chemical facility security  would be more effectively addressed by passage of specific legislation.  We  find that EPA could reasonably interpret its Clean Air Act authority to  cover chemical security, but also agree with the agency that this  interpretation could be open to challenges.
Section 112(r) of the Clean Air Act—added by the Clean Air Act  Amendments of 1990—imposes certain requirements on chemical facilities  with regard to “accidental releases.” The act defines an accidental release  as an unanticipated emission of a regulated substance or other extremely  hazardous substance into the air. Arguably, any chemical release caused  by a terrorist attack would be unanticipated and thus could be covered  under the Clean Air Act. An interpretation of an unanticipated emission as  including an emission due to a terrorist attack would provide EPA with  authority under Section 112(r)’s RMP provisions and the general duty  clause to require security measures or vulnerability assessments with  regard to terrorism.
The Clean Air Act’s RMP provisions could be interpreted to provide EPA  authority to require facilities to take actions to improve their security.  Under the RMP provisions, owners and operators of facilities producing,  processing, handling, or storing more than a threshold quantity of a  regulated chemical must detect and prevent or minimize “accidental  releases” and provide prompt emergency response to a release to protect  human health and the environment. For example, EPA could require  facilities to include security vulnerability assessments as part of their RMP  hazard assessments, identifying the potential public exposure that could  result from a terrorist attack and incorporating the threat of terrorism into  the “worst-case” release scenario. However, current EPA regulations do  not require facilities to assess their vulnerability to terrorist attack as part  of their RMP. EPA would need to revise its regulations to require that  facilities take the threat of terrorism into account.
EPA could also interpret the Clean Air Act’s general duty clause to address  chemical facility security from terrorism. The general duty clause requires  owners and operators of stationary sources producing, processing,  handling, or storing listed or other extremely hazardous substances to   (1) identify hazards that may result from releases using appropriate hazard  assessment techniques; (2) design and maintain a safe facility, taking the  steps necessary to prevent releases; and (3) minimize the consequences of  accidental releases that do occur. According to EPA, it would not have to  make any regulatory changes as it currently implements the general duty  clause through guidance. Thus, EPA could revise its existing guidance or  issue new guidance to include managing the risk of terrorism as within  owners and operators’ responsibility under the general duty clause.  Second, the clause covers not only the specific chemicals listed under the  RMP regulations, but also any other extremely hazardous chemicals. The  Clean Air Act does not define an extremely hazardous chemical, and EPA  interprets this term broadly. In addition, unlike the RMP provisions, the  general duty clause is not limited to facilities that have more than a  threshold amount of an extremely hazardous chemical.  Thus, facilities  that are not covered under the RMP provisions because their chemical  amounts are below the threshold amount are covered under the general  duty clause. However, if EPA chose to use the general duty clause to  address threats to facilities from terrorism, it would face some limitations.  Facility owners and operators must demonstrate safe practices at their  facilities, but there are no specific standards that facilities have to meet.   Since the general duty clause is not implemented by regulations, there are  no EPA standards specifically defining the duty.  Instead, EPA generally  looks to industry and other standards to indicate what facilities should do  to prevent and mitigate accidental releases.  With respect to chemical  facility security against terrorism, according to EPA, there are few such  standards.
While EPA believes that the Clean Air Act could be interpreted to  authorize EPA to require chemical plants to address security against  terrorism, there are a number of practical and legal arguments against this  interpretation. First, a release due to a terrorist attack is not entirely  unanticipated, as it is an intentional act. Second, a potential argument  against EPA using its general duty clause to require facilities to address  the threat of terrorism is the relationship between EPA’s general duty  clause and OSHA’s general duty clause.  Clean Air Act section 112(r)  provides that chemical facility owners and operators have a “general duty  in the same manner and to the same extent” as OSHA’s general duty  clause. However, the Department of Labor informed us that it does not  believe OSHA’s general duty clause provides it with authority to address  the threat of terrorism.  In responding to our draft, Justice expressed  concerns that the Clean Air Act does not provide sufficient protection  against dissemination of sensitive information that could be used by  terrorists.
In light of the litigation risk and the importance of an effective response to  the chemical security issue, EPA has decided not to attempt to require  vulnerability assessments or security enhancements under the Clean Air  Act. EPA has concluded that chemical facility security would be more  effectively addressed by passage of specific legislation. Currently, EPA is  working with the chemical industry to promote security enhancements.
section_title: Federal Agencies Have Not Comprehensively Assessed the Vulnerability of the Chemical Industry to Terrorism, but Have Taken Some Preliminary Steps
paragraphs: The federal government lacks comprehensive information on the chemical  industry’s vulnerabilities to terrorist attacks because it has not  comprehensively assessed the industry. However, federal agencies have  taken preliminary steps to assist the industry in its preparedness efforts.  For example, EPA has issued warning alerts to the industry and informally  visited about 30 high-risk facilities to learn about and encourage security  efforts. Neither EPA nor any other federal entity is currently monitoring or  documenting the extent to which the industry has implemented security  measures. In addition, the Department of Homeland Security is currently  determining how it will implement the National Strategy for Homeland  Security. Finally, in May 2002, Justice submitted an interim report to  Congress that described observations on security at 11 chemical  manufacturing facilities. However, as we reported in October 2002, Justice  has not prepared a more comprehensive final report to Congress on the  industry’s vulnerabilities, which it was required by law to deliver in August  2002.
subsections: section_title: EPA Has Developed a Strategy and Is Supporting Industry’s Voluntary Security Initiatives
paragraphs: EPA has not been called upon to comprehensively assess the vulnerability  of the chemical industry to terrorism but has conducted some limited  analysis of RMP facilities. For example, EPA officials conducted a  preliminary analysis of their database of RMP facilities to identify high-risk  sites for the Office of Homeland Security (OHS) and FBI. But these  facilities are only a portion of the universe of all industrial facilities that  house toxic or hazardous chemicals. While RMP facilities pose the greatest  danger of harm to the surrounding community in the event of a  catastrophic release, non-RMP facilities may also house dangerous  chemicals that could harm the surrounding population or be stolen to use  in a terrorist attack. EPA has not analyzed non-RMP facilities to determine  whether any of those facilities should be considered at high risk for a  terrorist attack.
EPA has assisted industry security efforts in the following ways:  In February 2000, EPA issued guidance to the industry to increase  awareness of the possible hazards of terrorist attacks. The guidance  included common security measures for companies to consider and  sources of information to assist with security. Since September 11, 2001,  EPA has also issued security advisories to several chemical industry  sectors, reminding them to be vigilant regarding the physical security of  chemicals.  In 2001, EPA advised a number of industry organizations regarding the  development of security guidelines and supported the development by  Justice and industry of methodologies for assessing vulnerabilities.  In 2001 and 2002, EPA, along with trade associations, sponsored a series of  regional meetings to share information on chemical security.  In 2002, EPA hosted seven training classes nationwide on the application  of vulnerability assessment methodologies; these classes were attended by  industry, federal, state, and local officials.
EPA is collecting e-mail addresses for RMP facilities to share threat or  hazard alert information quickly.  EPA may also use the e-mail system to  outreach to facilities for guidance and best practices.
EPA officials are incorporating informal discussions about security issues  during their visits to facilities for other programs, such as RMP and the  Emergency Planning and Community Right-to-Know Act. For example,  EPA Region VII, which is responsible for four midwestern states,  discussed security issues during visits to approximately 40 facilities in  2002.
Based on its analysis of RMP facilities, EPA visited 30 high-risk chemical  facilities specifically to discuss security issues. According to EPA officials,  these visits were designed to help the agency better understand the  facilities’ current and planned security efforts and provide an opportunity  to share suggestions for information tools that facilities can use to assess  and address security vulnerabilities. In early 2003, EPA briefed the  Administrator and OHS on these visits. EPA officials said that these visits  were not part of any enforcement or regulatory action, and meeting with  the EPA staff was at the discretion of the facility.
According to EPA officials, the agency developed a number of draft  principles for chemical facilities, such as requiring high-risk facilities to  conduct vulnerability assessments.  These principles were discussed with  an interagency task force that included the Office of Homeland Security.   The group decided to pursue specific chemical security legislation and is  fostering voluntary security improvements at chemical facilities.  Furthermore, in September 2002, EPA issued a Strategic Plan for  Homeland Security that describes its goal of supporting the chemical  industry in assessing and reducing vulnerabilities and strengthening  detection and response capabilities.  EPA plans to work with the industry  on voluntary initiatives but has no plans to monitor or document the  extent to which the industry has implemented voluntary security  measures.  EPA’s plans to accomplish this goal include    assisting industry in developing vulnerability assessment guidance,  identifying potential security enhancements, examining the feasibility of  integrating inherently safer technologies, and exploring the use of third- party verification for security at chemical facilities;  identifying site security concerns for small businesses and providing  outreach materials and technical assistance to these facilities; and    working with emergency planning organizations to assist them in  understanding site security hazards and prioritizing risks at chemical  facilities.
section_title: The Office of Homeland Security Has Played a Coordinating Role
paragraphs: The President’s Office of Homeland Security coordinated with other  federal agencies and worked with industry to address chemical security  concerns. OHS formed an interagency group, including EPA, OSHA, the  Department of Energy, and the Coast Guard, to discuss issues critical to  the chemical industry. OHS and EPA hosted a workshop attended by both  government and private sector officials to identify solutions to  vulnerabilities in the nation’s chemical infrastructure. OHS is compiling  information gathered from this workshop and those for other critical  industry sectors to report on critical infrastructure protection. Since its  creation in November 2002, the Department of Homeland Security has  been determining how it will implement the principles and goals outlined  in the Office of Homeland Security’s national strategy. In February 2003,  the Office of Homeland Security issued the National Strategy for the  Physical Protection of Critical Infrastructures and Key Assets, which  further defines the goals and objectives to secure infrastructures. The  strategy directs the Department of Homeland Security, in concert with the  White House, EPA, and other key departments and agencies, to work with  Congress to enact legislation to help protect the American public by  requiring certain chemical facilities, particularly those that maintain large  quantities of hazardous chemicals near population centers, to perform  vulnerability assessments and take reasonable steps to reduce the  vulnerabilities identified.
section_title: Justice Initiated Actions to Study the Vulnerability of the Chemical Industry but Has Not Fully Met Its Statutory Requirements
paragraphs: Justice has only partially fulfilled its mandate to review and report on the  vulnerability of chemical facilities to terrorist or criminal attack. The  Chemical Safety Information, Site Security and Fuels Regulatory Relief Act  of 1999 required Justice to conduct this review and prepare two reports— an interim report containing preliminary findings by August 5, 2000, and a  final report by August 5, 2002. Justice prepared and submitted an interim  report to Congress in May 2002, nearly 2 years after it was due, and has not  submitted its final report to Congress. The interim report was based on  observations made at 11 chemical manufacturing facilities Justice visited  to develop a methodology for assessing vulnerability. While the interim  report contains the elements required by the act, the results cannot be  generalized to the industry as a whole. In its fiscal year 2003 budget,  Justice asked for $3 million to conduct chemical plant vulnerability  assessments. In the February 2003 Conference report on Justice’s  appropriation act for fiscal year 2003, Congress directed that $3 million of  the funding being transferred to the Department of Homeland Security  from Justice’s general administration account be used for the chemical  plant vulnerability assessments. Justice believes that chemical plant  vulnerability assessments are now part of the mission of the Department  of Homeland Security.
While Justice has not assessed the vulnerability of the chemical industry, it  has provided the industry with a tool for individual facilities to use in  assessing their vulnerabilities. Justice, together with the Department of  Energy’s Sandia National Laboratories, developed a vulnerability  assessment methodology for evaluating the vulnerability to terrorist attack  of facilities handling chemicals. In July 2002, Justice made the  methodology publicly available for chemical companies to use in  identifying and assessing their threats, risks, and vulnerabilities. The  methodology also helps facilities develop recommendations to reduce risk,  where appropriate. The steps in the methodology include    assessing the type, nature, and physical characteristics of chemicals, as  well as a facility’s operational practices and security systems;     evaluating the consequences if a facility is targeted;    determining the attributes of the most likely threats (e.g., insiders,  activists, terrorists);    evaluating the effectiveness of current security measures against various    quantifying the risk as a function of the likelihood of attack, security  effectiveness, and consequences; and    conducting a cost-benefit analysis of possible security upgrades.
Justice’s FBI is the lead federal agency for the operational response to  terrorism, responsible for weapons of mass destruction threat assessment  and communicating warnings. The FBI’s National Infrastructure  Protection Center collects information from the U.S. intelligence  community, the FBI’s criminal investigations, other federal agencies, and  the private sector. If a threat involving chemical, biological, nuclear, or  radiological materials surfaces, subject matter experts in various units  within the agency assess the credibility of the threat. As a result of this  analysis, the FBI uses an array of mechanisms to issue and disseminate  warnings to appropriate entities in the federal government and the private  sector so that they can take immediate protective steps.
Working with ACC, an industry association representing chemical  manufacturers, the FBI created the Chemical Sector Information Sharing  and Analysis Center to collect and share threat information for the  chemical industry. This center, which began operation in April 2002,  provides a mechanism for companies to report unexplained or suspicious  incidents involving chemical facilities or chemicals in commerce directly  to the FBI. Likewise, the FBI can quickly exchange critical threat and  incident information with the chemical industry. To operate the center,  ACC uses its existing 24-hour communication network for sharing  information about chemical emergencies. Any company, not just ACC  members, engaged in the production, storage, transportation, sale, or  delivery of chemicals may participate.
Finally, agents in the FBI’s local field offices provide information and  technical assistance to state and local jurisdictions and to some chemical  facilities to bolster their preparedness to respond to terrorist incidents.  The FBI has contacted chemical facilities and distributed Chemical  Outreach booklets to chemical suppliers and manufacturers with  information relevant to identifying suspicious purchases, materials, or  precursors that may be used as weapons of mass destruction by terrorists,  as well as contact information for reporting suspicious activity.
section_title: Chemical Industry Has Taken Actions to Address Security Concerns, but Faces Significant Challenges in Preparing Against Terrorist Attacks
paragraphs: The chemical manufacturing industry has undertaken a number of  initiatives to address security concerns at chemical facilities, including  developing security guidelines and tools to assess vulnerabilities, but  challenges remain. The ACC requires its members to conduct security  vulnerability assessments and implement security improvements. Other  industry groups are also developing security initiatives, but the extent of  these efforts varies from issuing security guidance to requiring  vulnerability assessments. Moreover, the industry faces a number of  challenges in preparing facilities against terrorist attacks, including  ensuring that facilities obtain adequate information on threats and  determining the appropriate security measures given the level of risk.  Despite the voluntary industry initiatives to date, the extent of security  preparedness across the chemical industry is unknown. While the  Secretary of Homeland Security and the Administrator of EPA  commended the industry’s voluntary efforts to reduce the vulnerability of  U.S. chemical facilities to terrorist attacks, they stated that voluntary  efforts alone are not sufficient to assure the public of the industry’s  preparedness. They also stated they would support bipartisan legislation  to require the 15,000 chemical facilities nationwide that contain large  quantities of hazardous chemicals to comprehensively assess their  vulnerabilities and then act to reduce them.
subsections: section_title: Chemical Industry Has Undertaken a Number of Voluntary Initiatives to Address Security
paragraphs: In response to increased security concerns after the terrorist attacks of  September 11, 2001, chemical industry groups have undertaken a number  of security initiatives, including the development of security guidance and  assessment tools. All of the industry groups with whom we met have taken  actions such as forming security task forces, holding meetings and  conferences to share security information with members, and participating  in security briefings with federal agencies. In October 2001, ACC, the  Chlorine Institute, Inc., and the Synthetic Organic Chemical Manufacturers  Association (SOCMA) released guidelines developed by industry process  safety and security experts that outline elements of security programs and  suggest security practices that chemical plant managers can tailor to their  facilities’ needs. The guidelines address security at fixed facilities and are  intended to assist facility managers in determining appropriate security  measures commensurate with a facility’s level of risk. ACC also worked  with EPA, FBI, and others to organize regional security briefings around  the nation.
In addition to Justice’s methodology to assess chemical facilities’  vulnerabilities, industry groups developed tools for chemical facility  managers to utilize in assessing their security vulnerabilities and risks. The  Center for Chemical Process Safety (CCPS) of the American Institute of  Chemical Engineers, a research institution that promotes safety at  chemical facilities, developed a security vulnerability analysis that  chemical facilities can use to evaluate their risks and focus efforts on  hazardous chemical processes and sites where the severity of the attack  would be the greatest and the difficulty of attack would be the least. CCPS  has also formed a security vulnerability assessment users group to share  experiences and to learn from each other on the use of the methodology.   SOCMA tailored its vulnerability assessment model to the needs of smaller  facilities that manufacture a variety of chemicals in batches, rather than  those that continuously manufacture a single product.
Industry groups have also spearheaded efforts to address cyber-security  concerns. Attacks on computer systems that control chemical facility  operations pose a serious threat. Cyber-security is necessary to protect  critical information systems from loss, theft, or damage, as well as to  protect chemical processes from hazardous disruptions and unwanted  chemical releases. Working with the President’s Critical Infrastructure  Protection Board, a group of industry representatives—with expertise in  information security, the security of computers that control chemical  processes, and physical security—crafted a national chemicals sector  cyber-security strategy to improve the security of industry information and  information infrastructure. The chemical sectors cyber-security strategy is  part of the President’s National Strategy to Secure Cyberspace, which  outlines specific strategies for critical infrastructures.
In addition to security initiatives, the industry’s voluntary safety standards  could also potentially help lessen the impact of a terrorist action at a  facility. For example, the CCPS has published numerous process safety  guidelines aimed at reducing hazards.
section_title: Chemical Manufacturers’ Industry Association Requires Members to Assess Vulnerabilities and Enhance Security
paragraphs: In response to the terrorist attacks on September 11, 2001, ACC—whose  members own or operate approximately 1,000 facilities that are required to  submit RMPs—-now requires its members to identify, assess, and address  vulnerabilities. Companies must first rank their facilities according to risk  to determine the time frame for conducting vulnerability assessments and  making security enhancements. To rank facilities, companies use an ACC  screening tool to evaluate the difficulty of attack given existing security,  the severity of consequences of a successful attack on the surrounding  population, and the attractiveness of the target, according to factors such  as impact on the economy and disruption to other critical infrastructures.  ACC reports that all member companies completed the ranking process by  June 2002.
Facility operators then apply a vulnerability assessment methodology to  assess potential security risks. Companies may use the Justice  vulnerability assessment methodology developed with Sandia National  Laboratories, the CCPS methodology, or an equivalent methodology  approved by the center. About half a dozen companies have developed  methodologies that meet the center’s criteria and are tailored to the needs  of companies’ facilities. Justice’s and CCPS’s methodologies lead facilities  through a multistep process that includes: (1) evaluating on-site chemical  hazards, existing safety and security features, and the attractiveness of the  facility as a terrorist target; (2) using hypothetical threat scenarios to  identify how a facility is vulnerable to attack; and (3) identifying security  measures that create layers of protection around a facility’s most  vulnerable areas to detect, delay, or mitigate the consequences of an  attack. Using the companies’ rankings for their facilities, ACC established  time frames for completing the vulnerability assessment and implementing  security measures. The highest-risk ACC member facilities that must  submit RMPs are required to complete the process by December 2003.
Once facilities have made the necessary security improvements identified  by their vulnerability assessment, ACC’s security code generally requires  that third parties, such as insurance representatives, local emergency  responders, or local law enforcement officials, verify that these  improvements were implemented. The code does not require, however,  that third parties verify that the vulnerability assessment is conducted  appropriately or that the actions taken by the facility adequately address  security risks.
The ACC chemical facilities we visited were progressing on schedule with  implementation of ACC’s security code. All of these facilities completed  the prioritization screening assessment on schedule, and several had  identified a team of security and process safety experts to conduct the  vulnerability assessment. Facilities are not waiting until they complete  their vulnerability assessments to make security improvements. We  observed that facilities have implemented a range of security measures  since September 11, 2001. These measures include installing perimeter  fencing, adding or upgrading security cameras, increasing security guards  on site, adding or increasing vehicle inspections, and adding or improving  access control systems to restrict access to key areas. Facilities were also  planning additional security improvements, such as increasing security  training and drills and working to ensure that background checks are  conducted for contract personnel.
ACC has made efforts to enlist facilities beyond its membership in  voluntary security initiatives. ACC hopes that other chemical industry  organizations and groups that handle, transport, and store chemicals will  also adopt its security requirements, which are set forth in its Responsible  Care security code. According to ACC, through its Responsible Care  Partner Program, almost 90 partner companies, primarily transportation  companies, agree to implement and report on Responsible Care codes.  In  addition, associations that represent other industries agree to promote  Responsible Care codes to their members. One group, SOCMA, adopted  the Responsible Care security code for its member facilities as a condition  of membership. However, the extent to which all partner companies and  associations implement the codes is unclear.
Although implementation of Responsible Care is a condition of ACC  membership, ACC lacks an enforcement mechanism to ensure that  member companies comply. ACC stated that facilities must submit  periodic updates on their implementation of Responsible Care codes, but  ACC does not verify implementation or evaluate the adequacy of facility  measures. ACC officials stated that as of April 2002 they had not expelled  any member companies for failure to comply with the Responsible Care  initiatives. Beginning in 2004, ACC will publicly report the percentage of  member company facilities that have completed security vulnerability  assessments and third-party verification that security enhancements are  implemented, in keeping with the Responsible Care security code time  frames. By December 2005, member company headquarters will be  required to have implementation of Responsible Care requirements  certified by independent third-party auditors.
section_title: Other Facilities House Hazardous Chemicals, but Participation in Voluntary Initiatives Is Unclear
paragraphs: While ACC’s efforts are commendable, its member facilities comprise only  about 7 percent of the facilities required to submit risk management plans  to EPA. About 14,000 other facilities manufacture, produce, use, or store  chemicals in quantities that require compliance with EPA’s RMP program.  According to an EPA official, RMP data show that the largest quantities of  the most dangerous chemicals are located at facilities that use chemicals,  not at facilities that manufacture chemicals. These facilities include  agricultural suppliers, such as fertilizer facilities; petroleum and natural  gas facilities; food storage facilities; water treatment facilities; and  wastewater treatment facilities, among others. In addition, other facilities  that house hazardous chemicals listed under the RMP regulations are not  subject to RMP requirements because the quantities are below threshold  amounts. These facilities could potentially be at risk of terrorist attacks.
Some of these other facilities also have security initiatives underway. For  example:    The Fertilizer Institute, which represents fertilizer manufacturers as well  as fertilizer retail and distribution facilities, developed a security code  modeled after ACC’s code. The code encourages facilities to develop  vulnerability assessments and implement a plan based on the assessments.   In addition, a security vulnerability methodology for agricultural retail  facilities will be developed to assist this sector of the fertilizer industry.
The American Petroleum Institute, which represents petroleum and  natural gas facilities, published security guidelines developed in  collaboration with the Department of Energy that are tailored to the  differing security needs of industry sectors, such as oil and gas  exploration, refining, transportation, and distribution.
The International Institute of Ammonia Refrigeration, which represents  facilities such as food storage warehouses that use ammonia refrigeration,  developed site security guidelines and provided information about security  resources to its member facilities.
The Public Health Security and Bioterrorism Preparedness and Response  Act of 2002 requires, among other things, that all community water  systems serving more than 3,300 customers certify to EPA that they have  conducted an assessment of vulnerabilities to terrorist attacks.  According  to EPA, about 2,000 of these community water systems are also RMP  facilities.
Despite industry associations’ efforts to encourage security actions at  facilities, the extent of participation in voluntary initiatives is unclear. EPA  officials estimate that voluntary initiatives led by industry associations  only reach a portion of the 15,000 RMP facilities. Furthermore, EPA  officials stated that these voluntary initiatives raise an issue of  accountability, since the extent that industry group members are  implementing voluntary initiatives is unknown.
section_title: Industry Faces Challenges in Improving Preparedness
paragraphs: Even with the actions the chemical industry has taken to date to address  security, it still faces significant preparedness challenges. Trade  association and industry officials identified a number of concerns about  preparing against terrorist attacks. First, industry officials noted that they  need better threat information from law enforcement agencies, as well as  better coordination among agencies providing threat information. They  stated that chemical companies do not receive enough specific threat  information and frequently receive threat information from multiple  government agencies. Similarly, in developing its vulnerability assessment  methodology, Justice observed that chemical facilities need more specific  information about potential threats in order to design their security  systems and protocols. Industry officials also noted that efforts to share  threat information among industry and federal agencies will be effective  only if government agencies provide specific and accurate threat  information. Threat information also forms the foundation for some of the  tools available to industry to assess facility vulnerabilities. The Justice  vulnerability assessment methodology requires threat information as the  foundation for hypothesizing about threat scenarios, which form the basis  for determining site vulnerabilities.
Second, according to industry officials, chemical companies face a  challenge in achieving cost-effective security solutions, noting that  companies must weigh the cost of implementing countermeasures against  the perceived reduction in risk. Industry groups with whom we spoke  indicated that their member companies face the challenge of effectively  allocating limited security resources. Facilities must also determine what  constitutes a reasonable level of security against known or suspected  threats. For example, officials noted that preparing facilities against  extreme terrorist scenarios, such as jetliner attacks, would be  prohibitively expensive.
Third, facilities face pressure from public interest groups to implement  inherently safer practices (referred to in the industry as inherently safer  technologies), such as lowering toxic chemical inventories and  redesigning sites to reduce risks. Justice, in introducing its methodology to  assess chemical facilities’ vulnerabilities, also recognized that reducing the  quantity of hazardous material may make facilities less attractive to  terrorist attack and reduce the severity of an attack. While industry  recognizes the contribution that inherently safer technologies can make to  reducing the risk of a terrorist attack, industry officials noted that  decisions about inherently safer technologies require thorough analysis  and may shift, rather than reduce, risks. For example, reducing the amount  of chemicals stored may shift the risk onto the transportation sector as  reliance on rail or truck shipments increases. Finally, industry officials  underscored that relocating chemical storage tanks and other site redesign  strategies may be extremely costly and may have repercussions on other  facility operations.
Fourth, industry officials voiced concern about government agencies’  ability to protect sensitive information relating to facility vulnerabilities  and security. They stated that companies may be hesitant to share  information about site-specific vulnerabilities and security unless  government agencies implement specific safeguards to protect this  information. We have also reported that public-private information sharing  practices are central to critical infrastructure protection. Specifically,  practices such as taking steps to ensure that sensitive information is not  inappropriately disseminated and developing standards and agreements on  how shared information will be used and protected are critical to  successful information sharing.
Finally, industry officials stated that the industry faces a challenge in  engaging all chemical facilities in voluntary security efforts. Industry  officials noted that facilities that are not ACC members present a concern  because they may not be addressing security issues. Officials expressed  concern that smaller chemical companies may not be taking as much  action as larger companies to address vulnerabilities. Officials also  mentioned ACC’s efforts to engage other facilities that manufacture,  distribute, transport, store, or dispose of chemicals through the  Responsible Care program, noting that failure of all facilities to act may  affect public perception of the efficacy of voluntary industry initiatives.
Although the industry has taken steps to address security concerns, the  extent of security preparedness across the chemical industry is unknown.  Currently, no federal agency has assessed the extent of security  preparedness across the nation’s chemical facilities. EPA officials stated  that they do not know the extent that all facilities are addressing security  issues. During its work developing a chemical facility vulnerability  assessment methodology, Justice observed that some facilities may need  to implement more effective security systems and develop alternative  means to reduce the potential consequences of a successful attack.
section_title: Conclusions
paragraphs: Across the nation, thousands of industrial facilities manufacture, use, or  store hazardous chemicals in quantities that could potentially put large  numbers of Americans at risk of injury or death in the event of a chemical  release. Yet, despite all efforts since the events of September 11, 2001, to  protect the nation from terrorism, the extent of security preparedness at  U.S. chemical facilities is unknown. While some other critical  infrastructures are required to assess their security vulnerabilities, no  federal requirements are in place to require chemical facilities to assess  their vulnerabilities and take steps to reduce them. EPA believes the Clean  Air Act could be interpreted to require security actions at chemical  facilities, but the agency is currently taking a voluntary approach, leaving  it to industry to make improvements the industry believes are warranted.  However, no federal oversight or third-party verification ensures that  voluntary industry assessments are adequate and that necessary corrective  actions are taken. Furthermore, the sharing of information about facility  vulnerabilities and security practices, without the risk of compromising  sensitive information, among facilities and federal, state, and local  government would provide each group with the ability to respond  appropriately to any security threat. Our work demonstrates the need to  move to a comprehensive national strategy that does more to assure the  Congress and the public that chemical facilities have taken appropriate  security measures. By swiftly implementing a comprehensive approach to  reduce the risk of a terrorist-caused release, policymakers can better  protect American communities.
section_title: Recommendations for Executive Action
paragraphs: In order to ensure that chemical facilities take action to review and  address security vulnerabilities, we recommend that the Secretary of  Homeland Security and the Administrator of EPA jointly develop, in  consultation with the Office of Homeland Security, a comprehensive  national chemical security strategy that is both practical and cost  effective. This national strategy should  identify high-risk facilities based on factors including the level of threat  and collect information on industry security preparedness;    specify the roles and responsibilities of each federal agency partnering  with the chemical industry;    develop appropriate information sharing mechanisms; and    develop a legislative proposal, in consultation with industry and other  appropriate groups, to require these chemical facilities to expeditiously  assess their vulnerability to terrorist attacks and, where necessary, require  these facilities to take corrective action.
section_title: Agency Comments
paragraphs: We provided the Departments of Homeland Security and Justice, and EPA  with a draft of this report for review and comment. These agencies  generally agreed with the report’s findings and conclusions. EPA also  provided a number of technical comments and clarifications, which we  incorporated in the report as appropriate. The Department of Homeland  Security and EPA agreed that legislation requiring chemical facilities to  assess and address vulnerabilities to terrorist attack should be enacted.  Both agencies noted that the February 2003 President’s National Strategy  for the Physical Protection of Critical Infrastructures and Key Assets asks  the Department of Homeland Security, in concert with the White House,  EPA, and other key departments and agencies, to work with Congress to  enact legislation to help protect the American public by requiring certain  chemical facilities, particularly those that maintain large quantities of  hazardous chemicals near population centers, to perform vulnerability  assessments and take reasonable steps to reduce the vulnerabilities  identified. We revised our report to include the President’s newly released  strategy for protecting the chemical industry infrastructure. In responding  to our draft, Justice commented that our report failed to state Justice’s  conclusion that the risk of terrorists attempting in the foreseeable future  to cause an industrial chemical release is both real and credible. We  revised our report to address Justice’s comments and made other revisions  as appropriate. The Department of Homeland Security and Justice  provided written comments, which appear in appendixes I and II,  respectively.
We performed our work from April 2002 through March 2003 in  accordance with generally accepted government auditing standards.
As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution of it until 30 days from  the date of this letter. At that time, we will send copies of this report to  other interested parties and make copies available to others who request  them. In addition, the report will be available at no charge at GAO’s Web  site at http:www.gao.gov.
If you or your staff have any questions about this report, please call me or  Peg Reese, Assistant Director, at (202) 512-3841. Key contributors to this  report are listed in appendix IV.
section_title: Appendix I: Comments from the Department of Homeland Security
paragraphs: The following is GAO’s comment on the Department of Homeland  Security’s letter dated February 24, 2003.
subsections: section_title: GAO Comment
paragraphs: 1.  We revised our report to include the President’s newly released  strategy for protecting critical infrastructures.
section_title: Appendix II: Comments from the Department of Justice
paragraphs: The following are GAO’s comments on the Department of Justice’s letter  dated February 28, 2003.
subsections: section_title: GAO Comments
paragraphs: 1.  As discussed in our report, we give credit to Justice for conducting  threat assessments, working with industry to share intelligence and  facilitate liaison, and contacting chemical facilities through field  divisions to provide information and technical assistance.  2.  We agree with Justice that chemical facilities could be an attractive  target for terrorists. We have revised our report accordingly and have  added that Justice believes that the risk of terrorists attempting in the  foreseeable future to cause an industrial chemical release is both real  and credible. We also included additional information on the 1998-99  domestic terrorist plot to use a destructive device at a facility that  housed propane.  3.  We revised our report accordingly to include Justice’s longstanding  concern that the Clean Air Act does not provide sufficient protection  against dissemination of sensitive information, such as vulnerability  assessments, that could be used by terrorists for targeting.  4.  We disagree with Justice’s position regarding its mandate to review  and report on the vulnerability of chemical facilities to terrorist or  criminal attack. Our October 2002 report (see footnote 3 on page 3)  provides more detail on Justice’s actions to fulfill the report  requirements of the Chemical Safety Information, Site Security and  Fuels Regulatory Relief Act (CSISSFRRA) and our views on this  matter. We revised our report, however, to include discussion  concerning the February 2003 Conference report on Justice’s  appropriation act for fiscal year 2003 that directed that $3 million of  the funding transferred to the Department of Homeland Security be  used for chemical plant vulnerability assessments authorized by  CSISSFRRA.   5.  We revised the report to include additional information on the  vulnerability assessment methodology steps.
section_title: Appendix III: GAO Contacts and Staff Acknowledgments
subsections: section_title: GAO Contacts
section_title: Acknowledgments
paragraphs: In addition to those names above, Paige Gilbreath; Stan Kostayla; Linda  Libician; Joanna McFarland; Carol Herrnstadt Shulman; Amy Webbink;  and Leigh White made key contributions to this report.