Biosafety Laboratories: Perimeter Security Assessment of the Nation's Five BSL-4 Laboratories
Released: 2008-10-16T00:00:00

Letter

Background

The Public Health Security and Bioterrorism Preparedness and Response Act of 2002 created the government’s Select Agent Regulations, dividing primary responsibility for regulatory control of select biological agents between HHS and USDA. While HHS is responsible for regulating select agents that can potentially pose a severe threat to public health and safety, USDA regulates select agents that can potentially pose a severe threat to animal and plant health or animal and plant products. A number of “overlap agents” can pose both a public health threat and a threat to animals; in these cases, labs must register with either agency, but are not required to register with both. As mentioned above, all five registered BSL- 4 labs in the United States are registered with DSAT.

When a lab registers with DSAT to handle a select agent, a site-specific risk assessment must be conducted. Regulations governing the assessment do not specify who must perform it, meaning that the assessment can be performed by officials for the lab itself. Further, labs registering with DSAT are required to develop and implement a written security plan based on the site-specific risk assessment. According to the regulations, the security plan must be sufficient to safeguard against unauthorized theft, loss, or release of select agents and meet all the requirements outlined in the Select Agent Regulations. DSAT authored and utilizes the Select Agents and Toxins Security Information Document to provide possible practices and procedures that entities may use to assist them in developing and implementing their written security plans. Additional requirements include a written biosafety or biocontainment plan that describes the safety and containment procedures, and an incident response plan that includes procedures for theft, loss, or release of an agent or toxin; inventory discrepancies; security breaches; natural disasters; violence; and other emergencies. Prior to being issued a certificate of registration, an entity must comply with all security requirements and all other provisions of the Select Agent Regulations. A registration in the CDC’s Select Agent Program lasts for 3 years, after which it must be renewed if the entity chooses to retain possession of the select agents.

In addition to the five registered and operational BSL-4 labs, there are more labs currently under construction or in the planning stages. While expansion is taking place within the federal sector as well—there are many new federal facilities currently under construction or planned, which have one or more BSL-4 labs—there are also BSL-4 labs at universities, as part of state response, and in the private sector. These new facilities have not completed the registration process and were not fully operational as BSL-4 labs at the time of our assessment.

Results of Security Assessment

CDC regulations do not mandate that specific perimeter security controls are present at all BSL-4 labs, resulting in a significant difference in perimeter security between the nation’s five labs. According to the regulations, each lab must implement a security plan that is sufficient to safeguard select agents against unauthorized access, theft, loss, or release. However, there are no specific perimeter security controls that must be in place at every BSL-4 lab. While three labs had all or nearly all of the key security controls we assessed, two labs demonstrated a significant lack of these controls.

The results of our perimeter physical security assessment of the five registered BSL-4 labs are presented in table 1. The check marks in the table indicate the presence of specific security features at the labs we assessed, illustrating the varying levels of perimeter physical security controls present at the labs.

Although the presence of the security controls we assessed does not automatically ensure a secure perimeter, having most controls provides increased assurance that a strong perimeter security system is in place and reduces the likelihood of unauthorized intrusion. As discussed in appendix I, the strongest perimeter security systems use an active, integrated approach to security that takes advantage of multiple layers. For example, an active, integrated system links perimeter intrusion alarms to a CCTV network, allowing security officers to instantly view the location of an alarm. A discussion of each security assessment follows.

Lab A: The physical security controls of Lab A presented a strong visible deterrent from the outside, with 14 of the 15 key security controls in place. Lab A was located in a complex of other buildings that was separated from an urban environment by a perimeter security fence reinforced with airline cable to further strengthen the fence and deter unauthorized access. A roving patrol of armed guards was visible inside and outside the perimeter fence, while other guards manned gated entry inspection points. The gates incorporated technical support for the guards to assist them with the inspection of both private and commercial vehicles. Guards conducted ID checks at the gates and searched vehicles that did not have the appropriate access decals. Further, all trucks were required to enter a single gate containing an X-ray screening device. Past this outer perimeter, a further man-made barrier existed around the building containing the BSL-4 lab. Although Lab A had most of the security controls we focused on during our assessment, it did not have an active intrusion detection system integrated with the CCTV network covering the facility. This reduced the possibility that security officers could detect and quickly identify an intruder entering the building perimeter.

Lab B: Lab B was the only one of the five BSL-4 labs that had all 15 security controls. The lab was in an urban environment, but located in a complex of other buildings enclosed within an outer fenced perimeter. Roving patrols consisting of both armed security guards and local police walked on the exterior of the perimeter fence. The fence itself was reinforced with airline cable to further strengthen it along areas that bordered roads, serving to further protect against unauthorized intrusion from these public areas. There was a single gated inspection point to enter the complex manned by armed security guards. The inspection point incorporated technical support for the guards to assist them with the inspection of both private and commercial vehicles. Once inside the gate, man-made barriers and a natural (i.e., landscaped) barrier system stood between the gate and the lab itself. More armed guards conducted roving patrols inside the complex and guarded the entrance to the lab itself. Lab B also had a strong active integrated security system. According to lab officials, the system featured an integrated emergency management response whereby appropriate fire and rescue vehicles were automatically dispatched after an alarm.

Lab C: Lab C utilized only 3 of the 15 key security controls we assessed. The lab was in an urban environment and publicly accessible, with only limited perimeter barriers. During our assessment, we saw a pedestrian access the building housing the lab through the unguarded loading dock entrance. In addition to lacking any perimeter barriers to prevent unauthorized individuals from approaching the lab, Lab C also lacked an active integrated security system. By not having a command and control center or an integrated security system with live camera monitoring, the possibility that security officers could detect an intruder entering the perimeter and respond to such an intrusion is greatly reduced.

Lab D: Although Lab D did not have an armed guard presence outside the lab or vehicle screening, it presented strong physical security controls in all other respects, with 13 of the key 15 controls we assessed. Lab D was located within the interior of a complex of buildings, providing a natural system of layered perimeter barriers that included bollards for vehicle traffic. When combined with the presence of roving armed guard patrols, Lab D projected strong visible deterrents. It also utilized an active integrated security system so that if an alarm was activated, personnel within the command and control center could survey the alarm area though monitors and utilize pan/tilt/zoom cameras to further assess the alarm area. This permits security personnel to better coordinate and determine the appropriate response.

Lab E: Lab E was one of the weakest labs we assessed, with 4 out of the 15 key controls. It had only limited camera coverage of the outer perimeter of the facility and the only vehicular barrier consisted of an arm gate that swung across the road. Although the guard houses controlling access to the facility were manned, they appeared antiquated. The security force charged with protecting the lab was unarmed. Of all the BSL-4 labs we assessed, this was the only lab with an exterior window that could provide direct access to the lab. In lieu of a command and control center, Lab E contracts with an outside company to monitor its alarm in an off-site facility. This potentially impedes response time by emergency responders with an unnecessary layer that would not exist with a command and control center. Since the contracted company is not physically present at the facility, it is not able to ascertain the nature of alarm activation. Furthermore, there is no interfaced security system between alarms and cameras and a lack of live monitoring of cameras.

DSAT approved the security plans for the two labs lacking most key security controls, and approved these labs to participate in the Select Agent Program as BSL-4 labs. Conversely, during our assessment, we noted that the three BSL-4 labs with all or nearly all of our 15 key controls were subject to additional federal security requirements outside the purview of the Select Agent Regulations. For example, the National Institutes of Health both funds research requiring high containment and provides guidance and requirements that are widely used to govern many of the activities in high-containment labs. Other examples of more stringent regulations for BSL-4 labs include those of military labs that also follow far stricter Department of Defense physical security requirements. For example, Lab B had several layers of security, including a perimeter security fence and roving patrol of armed guards, visible inside and outside the perimeter fence. Although these security controls are not necessary for BSL-4 labs registering with DSAT, Lab B utilized these security controls to comply with more stringent federal requirements imposed by the agency owning the facility and incorporated these controls into its security plan. Security officials at the two labs with fewer security controls (Labs C and E) told us that management and administration had little incentive to improve security because they already met DSAT requirements. Some security officials also suggested that budgetary restrictions limited attempts to make security improvements.

Conclusions

Although numerous factors influence the security of a facility, two of the BSL-4 labs we assessed were lacking key perimeter security controls even though they met DSAT requirements. Our observation that the three labs with strong perimeter security all were subject to additional federal oversight outside of the DSAT program leads us to conclude that minimum specific perimeter security standards would provide assurance that all BSL-4 labs are held to the same security standard. Given that many new BSL-4 labs are under construction and will come online over the next few years, it is important for DSAT to ensure that there is no “weak link” in security among the nation’s BSL-4 labs.

Recommendation for Executive Action

To further enhance physical perimeter security at BSL-4 labs regulated by DSAT, we are recommending that the Director, CDC, take action to implement specific perimeter security controls for all BSL-4 labs to provide assurance that each lab has a strong perimeter security system in place. The CDC should work with USDA to coordinate its efforts, given that both agencies have the authority to regulate select agents.

Agency Comments and Our Evaluation

We received written comments on a draft of this report from the Assistant Secretary for Legislation of HHS. HHS agreed that perimeter security is an important deterrent against theft of select agents. They indicated that the difference in perimeter security at the five labs was the result of risk-based planning; however, they did not comment on the specific vulnerabilities we identified (e.g., an unsecured loading dock at one building housing a BSL-4 lab) and whether these should be addressed. In regard to requiring specific perimeter controls at all BSL-4 labs, HHS stated that it would coordinate with APHIS to seek input from physical security experts and the scientific community; the regulated community; professional associations; State, local, and tribal officials; and the general public as to the need and advisability of requiring, by Federal regulation, specific perimeter controls at each registered entity having a BSL-4 lab. They explained that specific security controls are not in place because Select Agent Regulations are focused on performance objectives rather than specific methods of compliance. We are encouraged that HHS plans to study this matter further, and suggest that, as part of this study, HHS reconsider whether the lack of many specific perimeter security controls at two of the nation’s five BSL-4 labs is acceptable.

HHS also requested that we provide references for the research that identified our 15 security controls as being appropriate for the assessment of the perimeter security of BSL-4 labs, identify the security experts that we consulted, and indicate whether these 15 security controls had been peer reviewed. We have notified HHS that we will work with them to understand the controls in more detail. As discussed in our report, we developed the 15 security controls based on our expertise in performing security assessments and our research of commonly accepted physical security principles. These principles are reflected in the security survey tool we used to evaluate each of the five BSL-4 labs. We have used this survey tool for similar security assessments in the past. Although we acknowledge that the 15 security controls we selected are not the only measures that can be in place to provide perimeter security, we determined that these controls (discussed in more detail in app. I) represent a baseline for BSL-4 lab perimeter physical security and contribute to a strong perimeter security system. Many of these controls— such preventing direct access to a lab via windows, or ensuring visitors are screened prior to entering a building containing a BSL-4 lab—are common- sense security measures.

HHS also provided us with technical comments, which we incorporated as appropriate. HHS’s comment letter is reprinted in appendix II.

As agreed with your office, unless you announce the contents of this report earlier, we will not distribute it until 30 days after its issue date. At that time, we will send copies of this report to the Secretary of Health and Human Services, the Director of the CDC, and other interested parties. The report will also be available at no charge on the GAO Web site at http://www.gao.gov.

If you or your staff have any questions concerning this report, please contact me at (202) 512-6722 or kutzg@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix III.

Appendix I: Perimeter Security Controls

To perform our perimeter security assessment of biosafety level (BSL) 4 labs, we identified 15 key perimeter security controls, based on our expertise and research of commonly accepted physical security principles, that contribute to a strong perimeter security system. A strong perimeter security system utilizes layers of security to deter, detect, delay, and deny intruders.

Deter. Physical security controls that deter an intruder are intended to reduce the intruder’s perception that an attack will be successful—an armed guard posted in front of a lab, for example.

Detect. Controls that detect an intruder could include video cameras and alarm systems. They could also include roving guard patrols.

Delay. Controls that delay an intruder increase the opportunity for a successful security response. These controls include barriers such as perimeter fences.

Deny. Controls that can deny an intruder include visitor screening that only permits authorized individuals to access the building housing the lab. Furthermore, a lack of windows or other obvious means of accessing a lab is an effective denial mechanism.

Some security controls serve multiple purposes. For example, a perimeter fence is a basic security feature that can deter, delay, and deny intruders. However, a perimeter fence on its own will not stop a determined intruder. This is why, in practice, layers of security must be integrated in order to provide the strongest protection. Thus, a perimeter fence should be combined with an intrusion detection system that would alert security officials if the perimeter has been breached. A strong system would then tie the intrusion detection alarm to the closed-circuit television (CCTV) network, allowing security officers to immediately identify intruders. A central command center is a key element for an integrated, active system. It allows security officers to monitor alarm and camera activity—and plan the security response—from a single location.

Table 2 shows 15 physical security controls we focused on during our assessment work.

Appendix II: Comments from the Department of Health and Human Services

Appendix III: GAO Contact and Staff Acknowledgments

GAO Contact

Acknowledgments

In addition to the contact named above, the following individuals made contributions to this report: Andy O’Connell, Assistant Director; Verginie Amirkhanian; Randall Cole; John Cooney; Elizabeth Isom; Barbara Lewis; Jeffrey McDermott; and Andrew McIntosh.