Critical Infrastructure Protection: Progress and Challenges in DHS's Management of Its Chemical Facility Security Program
Released: 2018-06-14T00:00:00

Letter

DHS Has Made Progress Addressing Past Challenges, But Some Actions are Still In Progress

Our past work has identified progress and challenges in a number of areas related to DHS’s management of the CFATS program including (1) the process for identifying high risk chemical facilities; (2) how it assesses risk and prioritizes facilities; (3) reviewing and approving facility security plans; (4) how it conducts facility compliance inspections; and (5) efforts to conduct stakeholder outreach and gather feedback. DHS has made a number of programmatic changes to CFATS in recent years that may also impact its progress in addressing our open recommendations; these changes are included as part of our ongoing review of the program.

Identifying High-Risk Chemical Facilities

In May 2014, we found that more than 1,300 facilities had reported having ammonium nitrate to DHS. However, based on our review of state data and records, there were more facilities with ammonium nitrate holdings than those that had reported to DHS under the CFATS program. Thus, we concluded that some facilities that were required to report may have failed to do so. We recommended that DHS work with other agencies, including the Environmental Protection Agency (EPA), to develop and implement methods of improving data sharing among agencies and with states as members of a Chemical Facility Safety and Security Working Group. DHS agreed with our recommendation and has since addressed it. Specifically, DHS compared DHS data with data from other federal agencies, such as EPA, as well as member states from the Chemical Facility Safety and Security Working Group to identify potentially noncompliant facilities. As a result of this effort, in July 2015, DHS officials reported that they had identified about 1,000 additional facilities that should have reported information to comply with CFATS and subsequently contacted these facilities to ensure compliance. DHS officials told us that they continue to engage with states to identify potentially non-compliant facilities. For example, as of June 2018, DHS officials stated they have received 43 lists of potentially noncompliant facilities from 34 state governments, which are in various stages of review by DHS. DHS officials also told us that they recently hired an individual to serve as the lead staff member responsible for overseeing this effort.

DHS has also taken action to strengthen the accuracy of data it uses to identify high risk facilities. In July 2015, we found that DHS used self- reported and unverified data to determine the risk categorization for facilities that held toxic chemicals that could threaten surrounding communities if released. At the time, DHS required that facilities self- report the Distance of Concern—an area in which exposure to a toxic chemical cloud could cause serious injury or fatalities from short-term exposure—as part of its Top-Screen. We estimated that more than 2,700 facilities with a toxic release threat had misreported the Distance of Concern and therefore recommended that DHS (1) develop a plan to implement a new Top-Screen to address errors in the Distance of Concern submitted by facilities, and (2) identify potentially miscategorized facilities that could cause the greatest harm and verify that the Distance of Concern of these facilities report is accurate. DHS has fully addressed both of these recommendations. Specifically, DHS implemented an updated Top-Screen in October 2016 and now collects data from facilities and calculates the Distance of Concern itself, rather than relying on the facilities’ calculation. In response to our second recommendation, in November 2016, DHS officials stated they completed an assessment of all Top-Screens that reported threshold quantities of toxic release chemicals of interest and identified 158 facilities with the potential to cause the greatest harm. As of May 2017, according to ISCD officials, 156 of the 158 facilities submitted updated Top-Screens and 145 of the 156 Top-Screens had undergone a quality assurance review process.

Assessing Risk and Prioritizing Facilities

DHS has also taken actions to better assess regulated facilities’ risks in order to place the facilities into the appropriate risk tier. In April 2013, we reported that DHS’s risk assessment approach did not consider all of the elements of threat, vulnerability, and consequence associated with a terrorist attack involving certain chemicals. Our work showed that DHS’s risk assessment was based primarily on consequences from human casualties, but did not consider economic consequences, as called for by the National Infrastructure Protection Plan (NIPP) and the CFATS regulation. We also found that (1) DHS’s approach was not consistent with the NIPP because it treated every facility as equally vulnerable to a terrorist attack regardless of location or on-site security and (2) DHS was not using threat data for 90 percent of the tiered facilities—those tiered for the risk of theft or diversion—and using 5-year-old threat data for the remaining 10 percent of those facilities that were tiered for the risks of release or sabotage. We recommended that DHS enhance its risk assessment approach to incorporate all elements of risk and conduct a peer review after doing so. DHS agreed with our recommendations and has made progress towards addressing them.

Specifically, with regard to our recommendation that DHS enhance its risk assessment approach to incorporate all elements of risk, DHS worked with Sandia National Laboratories to develop a model to estimate the economic consequences of a chemical attack. In addition, DHS worked with Oak Ridge National Laboratory to devise a new tiering methodology, called the Second Generation Risk Engine. In so doing, DHS revised the CFATS threat, vulnerability, and consequence scoring methods to better cover the range of CFATS security issues. Additionally, with regard to our recommendation that DHS conduct a peer review after enhancing its risk assessment approach, DHS conducted peer reviews and technical reviews with government organizations and facility owners and operators, and worked with Sandia National Laboratories to verify and validate the new tiering approach. We are currently reviewing the reports and data that DHS has provided about its new tiering methodology as part of our ongoing work and will report on the results of this work later this summer.

To further enhance its risk assessment approach, in fall 2016, DHS also revised its Chemical Security Assessment Tool (CSAT), which supports DHS efforts to gather information from facilities to assess their risk. According to DHS officials, the new tool—called CSAT 2.0—is intended to eliminate duplication and confusion associated with DHS’s original CSAT. DHS officials told us that they have improved the tool by revising some questions in the original CSAT to make them easier to understand; eliminating some questions; and pre-populating data from one part of the tool to another so that users do not have to retype the same information multiple times. DHS officials also told us that the facilities that have used the CSAT 2.0 have provided favorable feedback that the new tool is more efficient and less burdensome than the original CSAT. Finally, DHS officials told us that as of June 2018, DHS has completed all notifications and has processed tiering results for all but 226 facilities. DHS officials stated they are currently working to identify correct points of contact to update registration information for these remaining facilities. We are currently assessing DHS’s efforts to assess risk and prioritize facilities as part of our ongoing work and will report on the results of this work in our report later this summer.

Reviewing and Approving Facility Site Security Plans

DHS has also made progress reviewing and approving facility site security plans by reducing the time it takes to review these plans and eliminating the backlog of plans awaiting review. In April 2013, we reported that DHS revised its procedures for reviewing facilities’ security plans to address DHS managers’ concerns that the original process was slow, overly complicated, and caused bottlenecks in approving plans. We estimated that it could take DHS another 7 to 9 years to review the approximately 3,120 plans in its queue at that time. We also estimated that, given the additional time needed to do compliance inspections, the CFATS program would likely be implemented in 8 to 10 years. We did not make any recommendations for DHS to improve its procedures for reviewing facilities’ security plans because DHS officials reported that they were exploring ways to expedite the process, such as reprioritizing resources and streamlining inspection requirements. In July 2015, we reported that DHS had made substantial progress in addressing the backlog—estimating that it could take between 9 and 12 months for DHS to review and approve security plans for the approximately 900 remaining facilities. DHS officials attributed the increased approval rate to efficiencies in DHS’s review process, updated guidance, and a new case management system. Subsequently, DHS reported in its December 2016 semi-annual report to Congress that it had eliminated its approval backlog.

Finally, we found in our 2017review that DHS also took action to implement an Expedited Approval Program (EAP). The CFATS Act of 2014 required that DHS create the EAP as another option that tier 3 and tier 4 chemical facilities may use to develop and submit security plans to DHS. Under the program, facilities may develop a security plan based on specific standards published by DHS (as opposed to the more flexible performance standards using the standard, non-expedited process). DHS issued guidance intended to help facilities prepare and submit their EAP security plans to DHS, which includes an example that identifies prescriptive security measures that facilities are to have in place. According to committee report language, the EAP was expected to reduce the regulatory burden on smaller chemical companies, which may lack the compliance infrastructure and the resources of large chemical facilities, and help DHS to process security plans more quickly. If a tier 3 or 4 facility chooses to use the expedited option, DHS is to review the plan to determine if it is facially deficient, pursuant to the reporting requirements of the CFATS Act of 2014. If DHS approves the EAP site security plan, it is to subsequently conduct a compliance inspection.

In 2017, we found that DHS had implemented the EAP and had reported to Congress on the program, as required by the CFATS Act of 2014. In addition, as of June 2018 according to DHS officials, only 18 of the 3,152 facilities eligible to use the EAP opted to use it. DHS officials we interviewed attributed the low participation to several possible factors including:

DHS had implemented the expedited program after most eligible facilities already submitted standard (non-expedited) security plans to DHS; facilities may consider the expedited program’s security measures to be too strict and prescriptive, not providing facilities the flexibility of the standard process; and the lack of an authorization inspection may discourage some facilities from using the expedited program because this inspection provides useful information about a facility’s security.

We also found in 2017 that recent changes made to the CFATS program could affect the future use of the expedited program. As discussed previously, DHS has revised its methodology for determining the level of each facility’s security risk, which could affect a facility’s eligibility to participate in the EAP. DHS continues to apply the revised methodology to facilities regulated under the CFATS program and but it is too early to assess the impact on participation in the EAP.

Inspecting Facilities and Ensuring Consistent Compliance

In our July 2015 report, we found that DHS began conducting compliance inspections in September 2013, and by April 2015, had conducted inspections of 83 of the 1,727 facilities that had approved security plans. Our analysis showed that nearly half of the facilities were not fully compliant with their approved site security plans and that DHS had not used its authority to issue penalties because DHS officials found it more productive to work with facilities to bring them in compliance. We also found that DHS did not have documented processes and procedures for managing the compliance of facilities that had not implemented planned measures by the deadlines outlined in the plans. We recommended that DHS document processes and procedures for managing compliance to provide more reasonable assurance that facilities implement planned measures and address security gaps. DHS agreed and has taken steps toward implementing this recommendation. DHS updated its CFATS Enforcement Standard Operating Procedure (SOP) and has made progress on the new CFATS Inspections SOP. Once completed these two documents collectively are expected to formally document the processes and procedures currently being used to track noncompliant facilities and ensure they implement planned measures as outlined in their approved site security plans, according to ISCD officials. DHS officials stated they expect to finalize these procedures by the end of fiscal year 2018. We are examining compliance inspections as part of our ongoing work and will report on the results of our work in our report later this summer.

Stakeholder Outreach and Feedback

In April 2013, we reported that DHS took various actions to work with facility owners and operators, including increasing the number of visits to facilities to discuss enhancing security plans, but that some trade associations had mixed views on the effectiveness of DHS’s outreach. We found that DHS solicited informal feedback from facility owners and operators in its efforts to communicate and work with them, but did not have an approach for obtaining systematic feedback on its outreach activities. We recommended that DHS take action to solicit and document feedback on facility outreach consistent with DHS efforts to develop a strategic communication plan. DHS agreed and implemented this recommendation by developing a questionnaire to solicit feedback on outreach with industry stakeholders and began using the questionnaire in October 2016.

Chairman Shimkus, Ranking Member Tonko, and Members of the Subcommittee, this completes my prepared statement. I would be pleased to respond to any questions that you may have at this time.

GAO Contact and Staff Acknowledgements

If you or your staff members have any questions about this testimony, please contact me at (404) 679-1875 or curriec@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. Other individuals making key contributions to this work include John Mortin, Assistant Director; and Brandon Jones, Analyst-in-Charge; Michael Lennington, Ben Emmel, and Hugh Paquette.

This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.