Chemical Facility Security
Released: 2006-12-15T00:00:00

Introduction

The potential harm to public health and the environment from a large release of hazardous chemicals has long concerned the U.S. Congress. The sudden, accidental release in December 1984 of methyl isocyanate in an industrial incident at the Union Carbide plant in Bhopal, India, and the attendant loss of thousands of lives and widespread injuries spurred legislative proposals to reduce the risk of chemical accidents in the United States. For example, federal environmental laws were enacted in 1986 and 1990 to mitigate and reduce the risk of accidental releases of hazardous chemicals from manufacturing facilities, processing plants, and storage tanks. (These laws are discussed below.) The Hazardous Materials Transportation Act of 1975 was passed to protect the public and environment in the event of an accident during transportation of chemicals. Other federal laws coordinate preparedness planning and response to significant chemical spills (e.g., the Comprehensive Environmental Response, Compensation, and Liability Act).

The threat of terrorism manifested on September 11, 2001, prompted renewed congressional attention to the potential risks to public health and the environment posed by facilities handling large quantities of hazardous chemicals. Congress addressed chemical facility security when it enacted legislation establishing the Department of Homeland Security (DHS; P.L. 107-296 ). The law requires analysis of vulnerabilities and suggestions for security enhancements for "critical infrastructure." The Public Health Security and Bioterrorism Preparedness and Response Act of 2002 ( P.L. 107-188 ) and the Maritime Transportation Security Act (MTSA, P.L. 107-295 ) require vulnerability assessments, security plans, and incident response plans for some chemical facilities which supply drinking water or are located in ports. Many other chemical facilities remain unregulated with respect to terrorism. Thus, the 109 th Congress continued to discuss the risks and consequences of potential terrorist attacks on chemical facilities and possible actions the federal government might take to prevent or reduce them.

This report provides background information and summarizes issues relevant to existing and proposed requirements aimed at reducing risks to the general public of exposure to hazardous chemicals as a result of terrorist acts at U.S. facilities where chemicals are produced, processed, stored, or used. It considers the likelihood and severity of harm that might result from terrorist attacks on chemical facilities, as well as from illicit use of such facilities to gain access to hazardous chemicals (or to precursor chemicals that can be used to produce hazardous chemicals). Federal requirements for contingency planning and responding to chemical emergencies after they occur are not the focus of this report. In addition, it does not consider hazardous materials transport (or storage incidental to transport).

The report first describes the range of terrorist acts that might threaten chemical facilities and summarizes publicly available information relevant to risks: recent trends in terrorist activity, including chemical use by terrorists; expert estimates of the harm that might be inflicted through chemical terrorism; and assessments of the vulnerability of chemical facilities. The next section of the report discusses existing federal mandates and incentives for reducing risks of accidental releases from chemical facilities. The remainder of the report summarizes recent Administration and private sector initiatives to improve chemical site security; analyzes policy options and key issues; and describes legislation in the 109 th Congress.

Risks of Terrorism at Chemical Facilities

Nature of Hazards

Potential terrorist acts against chemical facilities might be classified roughly into two categories: direct attacks on facilities or chemicals on site, or efforts to use business contacts, facilities, and materials (e.g., letterhead, telephones, computers, etc.) to gain access to potentially harmful materials. In either case, terrorists may be employees (saboteurs) or outsiders, acting alone or in collaboration with others. In the case of a direct attack, traditional or nontraditional weapons may be employed, including explosives, incendiary devices, firearms, airplanes, or computer programs.

In obtaining chemicals, a terrorist's intent may be to use them as weapons or to make weapons, including explosives, incendiaries, poisons, and caustics. Access to chemicals might be gained by physically entering a facility and stealing supplies, or by using legitimate or fraudulent credentials (e.g., company stationary, order forms, computers, telephones or other resources) to order, receive, or distribute chemicals.

Recent Trends in Overall Terrorist Activities

According to February 2003 testimony by the Director of the Federal Bureau of Investigation (FBI) to the U.S. Senate, there were 353 known or suspected acts of terrorism (including terrorist acts by Americans) perpetrated within the United States between 1980 and 2001. Only a few incidents involved chemical facilities. Attacks during the 1990s claimed 182 lives and injured over 1,932 individuals. In comparison, during the 1980s, although there were many more terrorist or suspected terrorist incidents, only 23 people were killed and 105 were injured. Thus, although the total number of terrorist acts in the United States declined toward the end of the 20 th century, the casualties due to terrorism increased.

The same trends have been evident internationally, although there is considerable variation from year to year. The year 2003 had 208 international terrorist attacks on noncombatants, a few more than 2002, but 42% fewer than in 2001. There were 725 persons killed in 2002 and 625 persons (35 U.S. citizens) in 2003.

In terms of U.S. casualties due to international terrorism, 2001 is the most costly year on record, with 2,689 people killed. As noted by the FBI Executive Assistant Director for Counterterrorism and Counterintelligence, the attack of September 11, 2001, "marked a dramatic escalation in a trend toward more destructive terrorist attacks which began in the 1980s."

The September 11 attack also reflected a trend toward more indiscriminate targeting among international terrorists. The vast majority of the ... victims of the attack were civilians. In addition, the attack represented the first known case of suicide attacks carried out by international terrorists in the United States. The September 11 attack also marked the first successful act of international terrorism in the United States since the vehicle bombing of the World Trade Center in February 1993.

Other potentially important trends identified by intelligence agencies include:

an increase in activity by loosely affiliated extremists, both domestically and internationally; and the propensity of such groups to focus on producing mass casualties.

Trends in Chemical Terrorism

With respect to chemical and biological terrorism, hoaxes and unsuccessful attempts by terrorists to use chemicals increased throughout the 1990s. Loosely affiliated terrorist groups, in particular, have demonstrated a growing interest in chemical weapons and other weapons of mass destruction, but explosives are still the most frequently employed weapons.

During the 1990s, both international and domestic terrorists attempted to use explosives to release chemicals from manufacturing and storage facilities. Most of these attempts were abroad in war zones such as Croatia, including attacks on a plant producing fertilizer, carbon black, and light fraction petroleum products; other plants producing pesticides; and a pharmaceutical factory using ammonia, chlorine, and other hazardous chemicals. All of these facilities were close to population centers. In the United States, there were at least two instances during the late 1990s when criminals attempted to cause releases of chemicals from facilities. One involved a large propane storage facility, and the other a gas refinery.

Evidence that U.S. chemical facilities may be used by terrorists to gain access to chemicals also exists. For example, one of the 1993 World Trade Center bombers, Nidal Ayyad, became a naturalized U.S. citizen, graduated from Rutgers University, and worked as a chemical engineer at Allied Signal, from which he used company stationery to order chemical ingredients to make the bomb. According to a U.S. Prosecutor in the case against the bombers, though "some suppliers balked when the order came from outside official channels, when the delivery address was a storage park, or when [a co-conspirator] tried to pay for the chemicals in cash," others did not. Moreover, testimony at the trial of the bombers indicated that they had successfully stolen cyanide from a chemical facility and were training to introduce it into the ventilation systems of office buildings. More recently, chemical trade publications reportedly were found in al Qaeda hideaways.

Predicted Risks of Chemical Terrorism

The validity of any risk assessment depends on how much is known about the hazard, risks (probabilities), adverse effects, events and conditions that lead to or modify adverse effects or risks, and populations or environments that influence or experience adverse effects. The most accurate, and therefore the most useful, risk assessments generally are for familiar, frequently occurring hazards and events with impacts that are experienced with some regularity, such as severe storms or floods. In contrast, the risk of terrorist activity is unfamiliar (at least in the United States), rarely experienced, and likely to vary significantly over time, depending on rather unpredictable social and political phenomena.

The risk of terrorism targeting chemical facilities is particularly difficult to assess for at least three reasons:

There are few prior examples of terrorists targeting chemical facilities; Numerous factors theoretically may increase or decrease risks; and Interactions among factors influencing risks are dynamic and changing.

In part, these difficulties stem from the nature of terrorism and the terrorists' deliberate efforts to do what is least expectedâthat is, to defy prediction. For these reasons, most experts have not tried to quantify risks; existing analyses of chemical terrorism risks in the open literature are speculative and qualitative.

Until the mid to late 1990s, reports focused on the acquisition and use of chemical weapons, such as sarin or mustard gas. One of the most comprehensive of these reports was a 1995 review of the open literature on terrorism that was prepared for the Canadian Security Intelligence Service. According to this review of the literature, "[t]hose authors who have speculated about the future terrorist use of chemical agents in particular have generally rated its likelihood as quite high."

According to some, the risk also appears to be increasing. Many experts today believe that factors that might have inhibited proliferation and use of chemicals as weapons in the past are eroding. For example, some experts hypothesized several years ago that the combination of chemical and strategic skills necessary to create and deploy chemical weapons would prevent the lone terrorist from using them. Security experts now believe that lack of personal expertise no longer limits chemical weapon use, because there is a tendency for terrorists with similar extreme views to affiliate loosely with others with complementary skills and abilities. Moreover, the rising level of education worldwide means that more people have the requisite training in chemical engineering, and the Internet has simplified communications, training, and cooperation within geographically dispersed terrorist groups.

Others have argued that chemical attacks would be unlikely, due to the difficulties of producing and effectively delivering chemical agents in sufficient amounts to produce mass casualties. However, while this may be true with regard to military use on a large scale, where weapons are delivered by advanced systems, it is not necessarily relevant to terrorists who may have more limited ambitions. A 1999 report by the U.S. General Accounting Office (GAO, now the Government Accountability Office) summarized the situationâ

... many conflicting statements have been made in public testimony before Congress ... concerning the ease or difficulty with which terrorists could effectively disseminate a chemical or biological agent on U.S. soil and cause mass casualties.

GAO studied the threat and concluded that the ease or difficulty for terrorists to cause more than 1,000 casualties depends on the chemical or biological agent selected. The report statedâ

Experts from the scientific, intelligence, and law enforcement communities told us that terrorists do not need sophisticated knowledge or dissemination methods to use toxic industrial chemicals such as chlorine. In contrast, terrorists would need a relatively high degree of sophistication to successfully cause mass casualties with some other chemical and most biological agents.

On the other hand,

"[t]errorists with less sophistication could make a chemical or biological weapon and disseminate agents, but these would be less likely to cause mass casualties."

Other factors that might have inhibited chemical use by some terrorists in the past might not apply to loosely affiliated terrorist groups. For example, some experts argue that terrorists supported by nation-states have been reluctant to use chemical weapons for fear of offending other nations and neutral parties, particularly if the sponsors were signatories of the Chemical Weapons Convention. Another possible deterrent to chemical use, fear of retaliation, probably is of little concern to attackers with no identifiable homeland or headquarters. Lack of a homeland might also lessen concern about environmental damage that may be associated with chemical production. Finally, one must presume that occupational safety would be of limited concern to terrorists who are not accountable to a government, and who are willing to sacrifice their own lives for a religious, political, or social cause.

However, many experts believe that the relative risk of terrorism involving chemical weapons remains small. This point was stressed by John V. Parachini, a senior associate at the Center for Nonproliferation Studies, Monterey Institute of International Studies at a 1999 hearing before the U.S. House of Representatives, Committee on Government Reform, Subcommittee on National Security, Veterans Affairs, and International Relations. Referring to the risk of any use of chemical or biological weapons he stated:

... attacks with chemical and biological weapons are strikingly infrequent and the number of fatalities and casualties are far lower than those caused by conventional explosives. According to an analysis of 105 U.S. incidents featured in the Monterey Institute database from 1900 to 1998, only one fatality resulted from a [chemical or biological weapon] attack. This incident involved a 1973 assassination of an Oakland, California school superintendent by the Symbionese Liberation Army.

Severity of Harm

It is generally agreed that chemical agents are likely to be the least lethal of the three "weapons of mass destruction." In part, this judgment reflects the difficulty of producing and delivering large quantities of a lethal chemical to the target area prior to release. On the other hand, industrial chemicals and pesticides are readily available for purchase, and are stored in large quantities in thousands of locations throughout the United States, often near population centers. A key question for chemical facilities then is "How much damage could terrorists do using existing stationary chemical manufacturing, processing, distribution, and storage facilities?"

There are two key sources of information for answering this question: accident reports and hazard assessments conducted by facility personnel or outside experts. There is no comprehensive database for either kind of information, but various groups have used publicly available data to estimate hazard potential, usually limited to accidental releases of chemicals from chemical facilities.

A 1998 report by the U.S. Public Interest Research Group (US PIRG) and the National Environmental Law Center, Too Close to Home: Chemical Accident Risks in the United States , addressed the distribution of chemical facilities in the United States relative to population distribution. It stated that "more than 41 million Americans live within range of a toxic cloud that could result from a chemical accident at a facility located in their home zip code." Those 41 million Americans live in zip codes that contain manufacturing companies with "vulnerable zones" extending more than three miles from the facility, the report states. A "vulnerable zone" is the geographic area that could be affected by the worst possible accident at a facility. According to the report, the estimate of 41 million Americans at risk may underestimate the hazard, because it was based on "assumptions about facility and atmospheric conditions that would lead to small vulnerability zones." To produce the estimate, the study author stated that he used standard methodology used by the U.S. Environmental Protection Agency (EPA) and data on chemical storage from EPA's 1995 Toxics Release Inventory, a database of routine releases of industrial chemicals from manufacturing facilities.

Hazard estimates by James C. Belke, an EPA employee in the Chemical Emergency Preparedness and Prevention Office, are more detailed. Based on a preliminary analysis of approximately 15,000 facility risk management plans for chemical facilities that were filed under the Clean Air Act, Section 112(r) before September 25, 2000, Belke concluded that the median distance from a facility to the outer edge of its vulnerable zone is 1.6 miles in the case of toxic worst case scenarios, and 0.4 miles for flammable worst case scenarios. However, many facilities reported vulnerable zones potentially extending 14 miles from the facility (primarily for releases in urban areas of chlorine stored in 90-ton rail tank cars) and 25 miles (for releases in rural terrain of chlorine stored in 90-ton rail tank cars). Other chemicals for which reported vulnerable zones equaled or exceeded 25 miles include anhydrous ammonia, hydrogen fluoride, sulfur dioxide, chlorine dioxide, oleum (fuming sulfuric acid), sulfur trioxide, hydrogen chloride, hydrocyanic acid, phosgene, propionitrile, bromine, and acrylonitrile.)

Belke found the median population "affected" in a worst case accident was 15 people, for a flammable substance, while the median for toxic substances was 1,500 people. ("Affected" means potentially exposed. It is highly unlikely that all people within the vulnerable zone would be exposed due to a single release. However, anyone within the zone could be in the path of the chemical released, given certain environmental conditions.) Further EPA analysis of risk management plans submitted by facilities handling chemicals covered by the CAA Section 112 revealed that at least 123 plants reported a worst-case scenario with a vulnerability zone containing more than a million people. The analysis also found that more than 700 plants could threaten 100,000 people, and at least 3,000 facilities could threaten 10,000 people in the vicinity.

The Department of Justice (DOJ) analyzed EPA data and concluded that among facilities submitting risk management plans to EPA, more than 7,000 facilities projected worst case scenarios for toxic substances that could potentially affect more than 1,000 people. Almost 1,700 facilities reported the possibility that a less extreme accident might potentially affect more than 1,000 people.

Histories of actual accidents (as opposed to hypothetical worst-case scenarios) for facilities submitting risk management plans to EPA prior to October 21, 1999, were summarized in a working paper prepared by the Center for Risk Management and Decision Processes at the Wharton School, University of Pennsylvania. Of 14,500 reporting facilities, 1,145 reported 1,913 accidents between June 21, 1994 and June 20, 1999. Of the 1,145 facilities reporting accidents, 346 facilities had multiple accidents. Half of the chemicals for which risk management planning is required under the CAA Section 112(r) were involved in accidents. Half of the accidents resulted in reported injuries to workers. Accidents caused a reported 1,897 injuries and 33 deaths to employees, 141 injuries and no deaths to non-employees. No deaths were reported off-site. However, over 200,000 community residents were involved in evacuations and shelter-in-place incidents.

Further analysis by the Wharton group revealed that the risk of accidental chemical releases and of worker injuries or property damage increased with the size of the facility (from 10 to 1,000 full-time equivalent employees or FTEs). Note that this refers to accidents of any kind, not to worst-case events. In addition, facilities reporting that they handled large amounts and many types of chemicals had much higher accident rates than facilities handling smaller amounts and fewer types of chemicals. The probability that a facility had experienced a chemical accident of any size approached 100% for the very largest chemical manufacturers. Toxic chemicals were more strongly associated with worker injuries, while flammable chemicals were more strongly associated with property damage. No regional trends in accident rates were discovered (i.e., facilities in various geographical regions had similar accident rates).

Risk management plans submitted to the EPA report the worst-case potentially affected population for a release from a single process. As such, these populations may under-represent the population potentially affected as a consequence of a terrorist attack. Approximately 70% of RMP facilities possess reportable quantities of chemicals in amounts greater than a single process. For roughly 10% of RMP facilities, the quantity of chemical on-site is more than 10 times the quantity in the single process used to calculate the worst-case scenario. Some 250 facilities report having 100 times as much chemical on-site as is found in the single process. Thus, the EPA methodology for calculating the potentially affected population in the worst case, which was developed for accidental releases, may understate the potential worst-case consequences of a terrorist attack.

In contrast to the above figures, which all were based on hypothetical or actual accidents described in risk management plans, the Washington Post reported March 12, 2002, that a classified study conducted by the U.S. Army Surgeon General dated October 29, 2001, found that a terrorist attack resulting in a chemical release in a densely populated area could injure or kill as many as 2.4 million people. According to the news article, the study found "even middle-range casualty estimates from a chemical weapons attack or explosion of a toxic chemical manufacturing plant are as high as 903,400 people." The worst-case estimate of 2.4 million casualties from a chemical release was roughly half the surgeon general's estimate for casualties due to widespread use of biological weapons, according to the report. The Army Surgeon General recently explained that the estimate of 2.4 million casualties is of "the number of people who might request medical treatment during a total release of a large industrial chemical manufacturing plant, in a densely populated area, and under ideal weather conditions for maximum exposure." As in most studies of this kind, some question the magnitude and likelihood of the casualty estimates.

In 2004, the Department of Homeland Security used EPA data to estimate the number of potential fatalities that might result if all the various chemicals at a facility were released suddenly. The purpose of the exercise was to allow DHS to prioritize chemical facility sites for inspections. Assuming that released chemicals would move in the direction of the prevailing winds, DHS determined possible fatalities within a wedge-shaped zone. It identified two facilities that threaten at least one million people downwind. DHS selected 360 facilities for its attention in the near term based on these estimates.

In July 2004, the Homeland Security Council issued 15 national planning scenarios to guide federal, state, and local homeland security preparedness activities. Included in these scenarios are two that refer to industrial chemical releases. One describes a terrorist assault on a petroleum refinery while the other treats the release of a large volume of chlorine from an industrial facility. The planning figures cited for the hypothetical refinery attack include 350 fatalities and an additional 1,000 casualties. For the chlorine release, 17,500 fatalities, 10,000 severe injuries, and 100,000 additional casualties are postulated.

More recent calculations by DHS, based on more sophisticated models, have reduced hazard estimates.

In our best estimate, based on an incredible amount of modeling that we've done, the highest-risk facility in the United States would produce under 10,000 potential fatalities and less than 40,000 people that would demonstrate some effects in terms of anywhere from a near-death experience from exposure to inhalation of the toxic chemical to a minor skin blemish caused by irritation through contact with the chemical.

Chemical Site Vulnerability

CRS identified two publicly available reports that assess site security at U.S. chemical plants. In addition, investigative reports published in newspapers or documented with video recordings indicate that reporters have been able to visit various facilities without being supervised. The studies and selected newspaper accounts are summarized below.

Prior to September 11, an assessment of chemical plant site security by the Agency for Toxic Substances and Disease Registry (ATSDR) was considered by many to be the most comprehensive analysis that was publicly available. ATSDR researchers reviewed national statistics on domestic terrorism compiled by the FBI in 1995, and interviewed security staff from facilities and potential targets in one community with numerous chemical plants. ATSDR researchers concluded:

"security at chemical plants ranged from fair to very poor;" chemical plant security managers "were very pessimistic about their ability to deter sabotage by employees, yet none of them had implemented simple background checks for key employees such as chemical process operators"; and "none of the corporate security staff had been trained to identify combinations of common chemicals at their facilities that could be used as improvised explosives and incendiaries."

The full ATSDR report was never made public, but a DOJ report noted that

... among the 'soft targets' that the ATSDR identified as potential terrorist sites were chemical manufacturing plants (chlorine, peroxides, other industrial gases, plastics, and pesticides); compressed gases in tanks, pipelines, and pumping stations; and pesticide manufacturing and supply distributors.

The DOJ released a study April 18, 2000, describing the risk of terrorism aimed at chemical plants. It concluded that "the risk of terrorists attempting in the foreseeable future to cause an industrial chemical release is both real and credible." The study also noted that security at many industrial facilities generally is "not as substantial as the security at other comparable potential terrorist targets."

In April and May, 2002, six to seven months after September 11, 2001, the Pittsburgh Tribune-Review published a series of articles describing an investigation of plant security conducted by the paper's reporters. On April 7, 2002, the newspaper stated that "anyone has unfettered access to more than two dozen potentially dangerous plants in the region" (referring to western Pennsylvania). The author of the report continued:

The security was so lax at 30 sites that in broad daylight a Trib reporterâwearing a press pass and carrying a cameraâcould walk or drive right up to tanks, pipes and control rooms considered key targets for terrorists.

The report was based on reporters' trips to 30 plants in western Pennsylvania which have filed risk management plans under the Clean Air Act, Section 112. Two of the plants were among the 123 plants nationwide that projected potential risks to more than 1,000,000 residents in the event of a worst-case accident or attack. The 30 companies constituted more than half of the 61 sites in the region required to file risk management plans. Fifteen of the sites to which reporters gained unchallenged access were water treatment facilities in Pennsylvania and Maryland.

In May, another Tribune-Review article described a similar investigation of 30 additional plants in Houston, Baltimore, and Chicago. The report concluded that security was lax at some of "the potentially deadliest plants" in all three cities; access was easy to some sites owned by corporations with large security budgets; employees, customers, neighbors, and contractors "not only let a stranger walk through warehouses, factories, tank houses and rail depots, but also gave directions to the most sensitive valves and control rooms"; and access to 19 sites was allowed due to "unguarded rail lines and drainage ditches, dilapidated or nonexistent fences, open doors, poorly angled cameras and unmanned train gates."

Chemical manufacturers and users contacted by reporters said that they had bolstered security recently. Several site managers reported that they made immediate changes in procedures or construction plans in response to security breaches by the reporters. But security cannot be ensured "overnight," according to the president of the Pennsylvania Chemical Industry Council, and it can be expensive. For example, the newspaper reported that U.S. Steel spends more than $1 million each year to equip, train, and hire its own hazardous chemicals response team, firefighters, paramedics, and gate guards at its coke factory. The American Chemistry Council, which represents large chemical manufacturers, has reported that since September 11, 2001, its members have spent over $2 billion at about 2,000 facilities (about $1,000,000, on average, per facility).

Television crews again entered and photographed chemical storage areas in November 2003. Robert Full, Chief of the Allegheny County Department of Emergency Services in Pennsylvania testified February 23, 2004, before the Subcommittee on National Security, Emerging Threats, and International Relations, House Committee on Government Reform, that there continued to be facilities in his county "that one could walk straight in under the guise of darkness and cause significant damage and public danger." He stated, "Some of the facilities have no more security than maybe perhaps a padlock or a chain."

In mid-2004, surveys were distributed to 189 U.S. chemical facilities where workers were represented by the Paper, Allied-Industrial, Chemical and Energy Workers International Union (PACE). Of the 133 surveys returned, 125 were from facilities where workers agreed that there were quantities of hazardous materials on site large enough to cause a catastrophic event if they were released. Responses to the survey indicated that surveyed workers believed nearly three-quarters of the plants had improved systems to guard toxic chemicals and had conducted drills to respond to an intrusion by terrorists. On the other hand, according to employees who responded to questionnaires, fewer than half had improved communications, emergency response training, warning signals, or protective equipment, or contacted local first responders about the hazards on their sites. Nearly two-thirds of the plants had not discussed terrorist concerns with neighbors, according to surveyed workers.

Conclusion

Whether recent trends in domestic and international terrorism will continue into the future, and whether they will be reflected in risks to U.S. chemical facilities, is unknown. Historically, there have been very few terrorist attacks on chemical facilities in the United States. Therefore, the estimated risk of death and injury from such attacks in the immediate future is low relative to the likelihood of other hazardous events, such as industrial accidents or terrorist attacks on other targets using conventional weapons. For any individual chemical plant, the risk of attack is extremely small. However, the overall risks to chemical facilities may be increasing.

In contrast to the low probability of chemical terrorism, possible consequences for human health and the environment from such an event could be severe. Moreover, limited evidence suggests that chemical facilities may be "soft targets," lacking in adequate safeguards against criminal and terrorist attacks.

Federal Requirements Established Prior to September 11, 2001, To Reduce Risks at Chemical Facilities

Two key federal laws require or encourage certain chemical facility operators to reduce risks to the general public associated with releases of hazardous chemicals: the Emergency Response and Community Right-to-Know Act (EPCRA) and the Clean Air Act (CAA). Both focus on accidental releases of hazardous chemicals.

EPCRA

In 1986, two years after the Bhopal accident, Congress enacted EPCRA (codified at 42 U.S.C. 11001-11050) as Title III of the Superfund Amendments and Reauthorization Act ( P.L. 99-499 ). EPCRA mandated the establishment of State Emergency Response Commissions (SERCs) and Local Emergency Response Committees (LEPCs) to coordinate planning and response to potentially large releases of specified "extremely hazardous substances." The act requires facility operators, LEPCs, and SERCs to prepare contingency plans for such releases.

Facility managers are required to provide information to LEPCs and local emergency responders (fire fighters, police officers, etc.) about chemicals present at facilities and to notify those officials in the event of a sudden release. EPCRA requires local officials to provide information about emergency plans and chemical hazards to the general public.

EPCRA's reporting and disclosure requirements are meant to facilitate planning, but sometimes they also promote risk reduction. For example, facility managers concerned about community relations sometimes reduce use of particularly toxic or otherwise hazardous materials, sometimes to the point that they no longer have to report, because they no longer handle reportable quantities of EPCRA chemicals. In other cases, the public disclosure requirement may encourage them to change chemical processes and handling in order to reduce the risk of reportable spills.

Although EPCRA requires facility reporting and cooperation in local emergency response planning, and it may encourage risk reduction, it stops short of requiring facilities to assess or reduce risks of chemical releases. Instead, the act directed the EPA to study the problem and to identify any gaps in federal regulation.

CAA Section 112(r)

In 1990, data accumulated by EPA on chemical accidents in the United States prompted Congress again to address the threat of catastrophic releases of chemicals that might cause immediate deaths or injuries in communities. It amended the Clean Air Act (CAA) to mandate EPA oversight of risk management planning at facilities that handle more than specified threshold quantities of hazardous substances. The act defined "hazardous substances" to include chlorine, anhydrous ammonia, methyl chloride, ethylene oxide, vinyl chloride, methyl isocyanate, hydrogen cyanide, ammonia, hydrogen sulfide, toluene diisocyanate, phosgene, bromine, anhydrous sulfur dioxide, sulfur trioxide, and at least 100 other chemicals to be designated by EPA. EPA was directed to designate chemicals posing the greatest risks to human health or to the environment, based on three criteria: severity of potential acute adverse health effects, the likelihood of accidental releases, and the potential magnitude of human exposure. EPA promulgated a list of 77 acutely toxic substances, 63 flammable gases and volatile flammable liquids, and "high explosive substances" (59 Federal Register 4478, January 31, 1994). Fourteen chemicals met EPA criteria for listing as both toxic and flammable substances. The list was amended several times, notably on January 6, 1998 (63 Federal Register 640-645) to exclude explosive substances, and on March 13, 2000 (65 Federal Register 13243-13250) to exclude flammable substances when used as a fuel, or held for sale as a fuel at a retail facility. Selected categories of industries with large numbers of reporting facilities are identified in Table 1 .

The CAA Section 112(r) imposes "a general duty" on owners and operators of facilities producing, processing, handling or storing any "extremely hazardous substance" to detect and prevent or minimize accidental releases and to provide prompt emergency response to a release in order to protect human health and the environment. The act requires owners and operators of covered facilities to prepare Risk Management Plans (RMPs) that summarize the potential threat of sudden, large releases of certain chemicals, including the results of off-site consequence analysis (OCA) for a worst-case chemical accident, and facilities' plans to prevent releases and mitigate any damage. Plans were to be submitted to EPA and made "available to the public" by June 21, 1999. EPA is required to review RMPs regularly, and if necessary, require revisions. EPA has delegated this responsibility to some states and localities. (All states have authority to review RMPs at facilities that are major sources of air pollution, which are required to obtain permits under Title V of the Clean Air Act.) Plans must be revised and resubmitted to EPA every five years. Many facilities were required to submit updates by the end of June 2004.

In October 1996, the Accident Prevention Subcommittee of the Clean Air Act Advisory Committee to EPA created the Electronic Submission Workgroup to consider the technical and practical issues associated with an electronic database of risk management plans. In spring 1997, the workgroup unanimously agreed that EPA should provide full, unrestricted access via the Internet to most RMP information. However, advisors did not reach consensus regarding access to OCA data.

There were concerns that in facilitating electronic access to the general U.S. public through the Internet, EPA also would be facilitating access to these data internationally, which might permit misuse by terrorists. Several members of the Accident Prevention Subcommittee recommended EPA undertake a security study to determine how much risk might increase as a result of putting OCA data on the Internet. Aegis Research Corporation, ICF Incorporated, and Science Applications International Corporation conducted the security study for EPA. The Agency concluded from the study thatâ

... the risk (although still very small) was slightly more than two times higher with unrestricted availability of the RMP with OCA data on the Internet. This increase reflects several factors, including the nature of the OCA data elements and the enhanced accessibility of data on the Internet to an international audience. Taken together, the primary utility of the unrestricted RMP and OCA data to a terrorist emerges from the capability to scan across the entire country for the "best" targets.

In December 1997, EPA began discussions with the FBI and other federal agencies about the electronic RMP distribution plan. National security concerns centered on the OCA data and their potential utility to terrorists. An interagency agreement was reached in late October 1998 that OCA data would not be included in RMP information placed on the Internet. Instead, EPA would make "appropriate" OCA data available in some form on request, but access would be restricted and not anonymous. The possibility that OCA data could have been distributed via the Internet remained, however, because it could have been obtained and distributed by any citizen under the Freedom of Information Act (FOIA), according to the EPA Legal Counsel.

To address the security concerns raised by the Section 112(r) requirements, the Clinton Administration submitted draft legislation to Congress May 7, 1999. Congress enacted an amended version of the legislation as an amendment to S. 880 , the Chemical Safety Information, Site Security and Fuels Regulatory Relief Act ( P.L. 106-40 ). The new law amended Section 112 of the CAA to exempt OCA data from disclosure under FOIA, and limited public availability until EPA and DOJ issued regulations in August, 2000.

The final RMP regulation on data access was published August 4, 2000. It allows public access to paper copies of sensitive OCA information through federal reading rooms, approximately one per state, and provides Internet access to the OCA data elements that pose the least serious criminal risk. State and local agencies are encouraged to provide the public with read-only access to OCA information on local facilities. At the federal reading rooms, members of the public may read OCA information for up to 10 facilities per calendar month and for all facilities with potential effects in the jurisdiction of the local emergency planning committee. State and local officials and other members of the public may share OCA information as long as the data are not conveyed in the format of sensitive portions of the RMP or any electronic database developed by EPA from those sections. A Clinton Administration proposal to implement the final rule (66 Federal Register 4021, January 17, 2001) would have allowed people to view plans of facilities outside their local area and enhanced access for "qualified researchers." The draft plan was rescinded by the Bush Administration (66 Federal Register 15254, March 16, 2001).

The 1999 Act also directed GAO to report to Congress within three years (i.e., before August 2002) on "the adequacy of chemical information required to be submitted to local emergency response personnel to help them respond to chemical incidents, the adequacy of the delivery of that information, and the level of compliance with the requirement to submit the information." That report was released July 31, 2002. GAO concluded that EPA officials believe industries generally are complying with reporting requirements. GAO's conclusions about the adequacy of information and its delivery were tentative and could not be generalized to the universe of LEPCs.

DOJ also was directed to report to Congress within three years on the extent to which RMP regulations led to actions "that are effective in detecting, preventing, and minimizing the consequences of releases of regulated substances that may be caused by criminal activity," the vulnerability of facilities to criminal and terrorist activity, "current industry practices regarding site security," and security of transportation of substances listed under CAA Section 112(r)." The law directed DOJ to consult with state, local and federal agencies, affected industry, and the public in preparing the report, and to submit any recommendations to Congress. An interim report was due within one year of enactment (i.e., by August 2000), and a final report within three years of enactment (i.e., by August 2002). DOJ missed both deadlines. The Natural Resources Defense Council (NRDC) filed a lawsuit against DOJ March 11, 2002, asserting that DOJ unlawfully withheld or unreasonably delayed the report's submission to Congress. The interim report was released to Congress May 30, 2002, but withheld from the public. On June 3, 2002, DOJ filed a motion to dismiss the NRDC lawsuit. The NRDC moved to dismiss its lawsuit on July 1, 2002.

A GAO study released October 10, 2002, concluded that DOJ failed to complete the mandated study, and that the Department had the funds to do so, although it had no specific appropriation. "Generally, when Congress imposes a new requirement on an agency but does not appropriate funds specifically to implement it, the agency must use existing appropriations to fund the requirement."

After September 11, 2001

Administrative Initiatives

The events of September 11, 2001, bolstered the view that access to information about facilities should be restricted if it might make them more vulnerable to terrorist attacks. This led EPA to limit Internet access on its website to "sensitive" data.

Early in October 2001, EPA removed from its website facility-specific information of a general nature that had been compiled from the executive summaries of risk management plansâfor example, about the physical state and concentrations of chemicals at facilities and the duration of a possible chemical releaseâwhich previously had been considered acceptable for Internet posting. That information remained available on the Internet through OMB Watch's Right-to-Know Network (RTK NET), but EPA refused repeated requests (including a formal FOIA request) to provide updated information about facility plans. EPA released that information only after OMB Watch filed a complaint in the U.S. District Court for the District of Columbia. In July 2005, EPA provided the electronic database to OMB Watch, which promptly made it accessible on its website.

In March 2002, EPA restricted access to Envirofacts, a link to several EPA databases that allowed the user to access facility-specific information about chemical releases, compliance with environmental laws, and other issues. The next week, the White House sent a memorandum to all federal agencies, ordering them to further review and protect information that might be used to threaten national security or public safety. On May 6, 2002, President Bush signed an administrative order granting the EPA Administrator the authority to classify as "secret" information that might pose a national security risk.

On the other hand, the attacks of September 11 led to increased communication among government officials at all levels, as well as facility owners and operators. For example, EPA advised pesticide companies and applicators to be especially vigilant about physical security of chemicals and equipment. The Agency issued a "chemical safety alert" tailored to the security needs of the pesticide industry, based on an earlier paper on site security of chemical plants that first was issued in February 2000. In September 2002, EPA also sent about 9,400 drinking water utilities advice about securing facilities from terrorists. (About 2,000 drinking water utilities submit risk management plans that include worst-case scenarios under the CAA Section 112(r).)

In February 2003, the White House released The National Strategy for the Physical Protection of Critical Infrastructures and Key Assets. It outlines goals, principles, "a unifying structure," roles and responsibilities, and the major cross-sector and sector-specific initiatives of national efforts to secure infrastructures and "assets vital to our public health and safety, national security, governance, economy, and public confidence." Chemical facilities are addressed in connection with three critical infrastructure sectors: the chemical industry and hazardous materials, water, and energy. EPA was the designated lead federal agency for the chemical industry and water, while the Department of Energy (DOE) was the designated lead agency for energy.

With respect to the chemical industry and hazardous materials, the Strategy acknowledged both the potential economic consequences of a successful attack on the sector and the potential threat to public health and safety. It aimed to assure supply to downstream users of chemical products, to protect and assure the quality of chemical stockpiles, and to reduce the risk of malicious use of inherently hazardous chemicals. The Strategy noted that "there is currently no clear, unambiguous legal or regulatory authority at the federal level to help ensure comprehensive, uniform security standards for chemical facilities." In particular, the Strategy observed that federal laws might be out-of-date and no longer effective for monitoring and controlling access to dangerous substances. The President proposed that DHS, in concert with EPA, should "work with Congress to enact legislation to require certain chemical facilities, particularly those that maintain large quantities of hazardous chemicals in close proximity to population centers, to undertake vulnerability assessments and take reasonable steps to reduce the vulnerabilities identified." The Strategy also proposed that EPA, in concert with DHS, should review current laws and regulations pertaining to "the distribution and sale of highly toxic pesticides and industrial chemicals." Finally, the Strategy suggested that DHS and EPA should encourage participation in the chemical sector's Information Sharing Analysis Center. The fact that security can be expensive also was noted.

The Strategy described the importance of water from a public health and an economic standpoint and noted that security of the water sector against terrorism had been greatly enhanced since September 11, 2001. Challenges facing the water sector, according to the Strategy, included the need to protect against intentional release of toxic chemicals so as to protect the safety of people who reside or work near water facilities. The Strategy proposed that EPA and DHS identify better ways to secure key points of storage and distribution; improve monitoring and analysis, information exchange, and contingency planning; and manage risks due to interdependencies with other critical infrastructures.

The energy sector was divided into two sections: electricity and the oil/natural gas industries. Overall, energy was described as "essential to our economy, national defense, and quality of life." The Strategy proposed that DHS and DOE work with state and local governments and industry to identify "appropriate levels of redundancy" and requirements for "designing and enhancing reliability." In addition, DHS and DOE were to work with oil and natural gas industry representatives to "define consistent criteria for criticality, standard approaches for vulnerability and risk assessments," and "physical security training for industry personnel." An advisory task force was to be convened by DHS and DOE to identify appropriate planning requirements and approaches. Finally, the Strategy proposed that DHS and DOE work with industry "to develop regional and national programs for identifying spare parts, requirements, notifying parties of their availability, and distributing them in an emergency." There is no mention in this section of the hazardous chemicals present in some facilities in the energy sector. However, it may be the Administration's intention that certain facilities, such as oil refineries, electric/gas utilities, and bulk storage facilities, would be included in, and targeted by initiatives in, multiple critical infrastructure sectors.

As the war began in Iraq, the President launched Operation Liberty Shield, a surveillance program to provide additional security for potentially threatened facilities in the critical infrastructure. Chemical plants were among the potential focal points of the initiative.

On December 17, 2003, the President issued Homeland Security Presidential Directive (HSPD) 7, transferring to DHS all EPA authority for overseeing the security of chemical facilities, with the single exception of drinking water and water treatment plants. In addition, the directive revised the Administration's strategy for protecting critical infrastructure by designating DHS the lead agency for the chemical sector. The directive requires that DHS "identify, prioritize, and coordinate the protection of critical infrastructure and key resources with an emphasis on critical infrastructure and key resources that could be exploited to cause catastrophic health effects or mass casualties comparable to those from the use of a weapon of mass destruction" (HSPD 7, paragraph 12). In addition, DHS must conduct or facilitate vulnerability assessments of the chemical sector and "encourage risk management strategies to protect against and mitigate the effects of attacks." Finally, all departments and agencies are directed "to work with sectors relevant to their responsibilities to reduce the consequences of catastrophic failures not caused by terrorism" and to cooperate with the DHS Secretary.

Private Sector Initiatives

Although trade associations for the chemical industries have been engaged in emergency planning for many years, and began developing guidelines for site security at least a year before September 11, 2001, the events of that date infused on-going efforts with commitment and energy that previously were not evident.

The American Chemistry Council (ACC, formerly the Chemical Manufacturers Association), the Chlorine Institute, Inc., and the Synthetic Organic Chemical Manufacturers Association issued Site Security Guidelines for the U.S. Chemical Industry on October 23, 2001. The guidelines build on "Management Practice 15: Site Security" in the Responsible CareÂ® Employee Health and Safety Code. Responsible CareÂ® is the ACC's response to general public concerns about the manufacture and use of chemicals. Members of the ACC are required to commit to the principles of Responsible CareÂ® and "to support a continuing effort to improve the industry's responsible management of chemicals" by continually improving their health, safety and environmental performance; listening and responding to public concerns; assisting other companies to achieve optimum performance; and reporting their goals and progress to the public." There are today about 130 corporate ACC members operating approximately 2,000 chemical facilities, representing almost 90% of U.S. chemical productive capacity. About half of the ACC facilities are covered by the CAA Section 112(r) requirements for risk management planning. The ACC guidelines for site security are general, and must be adapted by chemical companies to meet site requirements.

During April 2002, ACC circulated a draft of a Security Code of Management Practicesâ

... to help companies achieve continuous improvement in security performance using a risk-based approach to identify, assess and address vulnerabilities, prevent or mitigate incidents, enhance training and response capabilities, and maintain and improve relationships with key stakeholders.

On June 5, 2002, the ACC Board of Directors approved the code and voted to make it mandatory for ACC members. Under the Security Code, ACC members are required to evaluate site security using vulnerability assessment methodology equivalent to that developed by the Department of Energy's Sandia Laboratories for the Department of Justice or by the Center for Chemical Process Safety (an industry-funded research center). They are then required to implement security enhancements commensurate with the risks identified by the assessments. Other key requirements of the code include

training and drills for employees, contractors, customers, and suppliers; consideration of process changes, material substitutions, and other inherently safer approaches to chemical production; evaluation, response, and reporting of security threats; and internal audits.

ACC members began by assessing security, including computer security, at high-risk facilities, as well as from supplier to manufacturer, to wholesaler, to retailer, and finally to customer. On March 7, 2003, ACC announced that all of its member companies had completed site vulnerability assessments for their 120 highest priority facilities, prior to the end of 2002, a deadline established by the industry's security code. In early 2005, ACC announced that members had completed implementation of security measures at all 2,040 of their facilities. However, the security code does not require specific expenditures for risk reduction; rather, it recommends decisions should be based on an evaluation of risks and costs. According to ACC, facilities have spent more than $2 billion since September 11 to improve security.

In addition to developing guidelines and a management code on site security, ACC and other chemical trade organizations have been communicating extensively with one another and with government officials about how to reduce the risks of chemical terrorism. For example, ACC and the Association of American Railroads formed a task force to develop strategies to ensure the safety of communities near chemical and rail facilities. In addition, as mentioned above, the Center for Chemical Process Safety has developed a risk-based methodology for assessing the vulnerability of chemical facilities to terrorist attacks. The Synthetic Organic Chemical Manufacturers Association (SOCMA) has developed a vulnerability assessment methodology for smaller chemical producers. In addition, SOCMA has adopted the ACC security code as a condition of membership. According to Tom Hall, director of stewardship for CropLife America (a pesticide industry trade association), pesticide and fertilizer distributors represented by CropLife America, the Fertilizer Institute, and the Agricultural Retailers Association formed a working group to tailor a vulnerability assessment methodology for rural facilities, where theft is a greater threat than a direct attack on a facility. A document, Guidelines to Help Ensure a Secure Agribusiness , was released October 24, 2002. Finally, the American Petroleum Institute has published security guidelines developed in consultation with the Department of Energy.

GAO examined the voluntary initiatives underway in a report released in March 2003, Homeland Security: Voluntary Initiatives Are Under Way at Chemical Facilities but the Extent of Security Preparedness Is Unknown . GAO concluded that many initiatives are admirable, but "the extent of security preparedness at U.S. chemical facilities is unknown ... [because] no federal requirements are in place to require chemical facilities to assess their vulnerabilities and take steps to reduce them ... [and] no federal oversight or third-party verification ensures that voluntary industry assessments are adequate and that necessary corrective actions are taken."

Congressional Action

The 107 th Congress passed the Public Health Security and Bioterrorism Preparedness and Response Act of 2002 ( P.L. 107-188 ), which requires many community water systems to perform vulnerability assessments and to prepare emergency preparedness and response plans. Some of these facilities handle significant quantities of hazardous chemicals. Funding is authorized to assist communities in complying with the act. It also directs EPA to review methods to prevent, detect, and respond to threats to water safety and infrastructure security. P.L. 107-117 provided EPA with roughly $90 million to enhance the security of drinking water treatment facilities.

The 107 th Congress also enacted the Maritime Transportation Security Act (MTSA, P.L. 107-295 ), which requires the DHS Secretary to identify port facilities "that pose a high risk of being involved in a transportation security incident," and to conduct a vulnerability assessment of such facilities. Facility owners or operators are required to develop and submit to DHS both security plans and incident response plans that deter "to the maximum extent practicable a transportation security incident or a substantial threat of such a security incident"; are consistent with national and area security plans; and conform to requirements specified by the U.S. Coast Guard. DHS must review and approve each plan. The act also authorized a grant program that finances security upgrades. For more information about the MTSA and related issues, see CRS Report RL31733, Port and Maritime Security: Background and Issues for Congress , by [author name scrubbed].

P.L. 107-296 , establishing DHS, does not address chemical plant security directly. However, the law does require DHS to analyze vulnerabilities and recommend methods of enhancing site security at facilities that are part of the "critical infrastructure." As noted above, the Administration has identified chemical facilities as part of the critical infrastructure in the National Strategy for the Physical Protection of Critical Infrastructures and Key Assets. Chemical facilities are included in several sectors: water utilities, the energy sector, and the chemical and hazardous materials sector. The law exempts from public disclosure requirements (i.e., FOIA) any information about physical and cyber security if it is submitted voluntarily to DHS by such facilities for use by that agency related to "the security of critical infrastructure and protected systems." Disclosure under the authority of state or local laws also is prohibited. Unauthorized disclosure of "critical infrastructure information" by government employees is punishable by imprisonment, fines, and removal from office.

The 108 th Congress amended the MTSA in the Coast Guard and Maritime Transportation Act of 2004, P.L. 108-293 , on August 9, 2004. Title VIII of that act requires the DHS to submit a plan for a maritime security grant program, including recommendations on how funds should be allocated.

The 109 th Congress enacted security provisions attached to the DHS appropriations bill for 2007, H.R. 5441 . The law, P.L. 109-295 , provides authority to DHS for three years to issue regulations for high-risk chemical facilities, other than drinking water and wastewater treatment facilities and facilities in ports. DHS is directed to establish risk-based security performance standards for such facilities, and designated chemical facilities are required to prepare vulnerability assessments and facility security plans. DHS has authority to inspect facilities and to order compliance. Failure to comply with an order may be punished with a civil penalty of $25,000. There are no criminal penalties for noncompliance, although criminal penalties are authorized for unauthorized disclosure of "protected information." In the event of repeated compliance failures, DHS may order a facility to cease operations. The law is silent on numerous issues debated during markup of other bills reported in the House and the Senate, including the criteria for weighing risks of various facilities, federal preemption of state and local right-to-know laws, how to facilitate congressional oversight, and the role of IST.

Policy Options

September 11, 2001 prompted policy makers to reconsider federal policy options regarding potential terrorist threats to chemical facilities. A range of possible strategies is summarized below. Additional information on this topic is provided by CRS Report RL33043, Legislative Approaches to Chemical Facility Security , by [author name scrubbed].

Status Quo

Congress could rely on existing mechanisms in the public and private sectors to continuously evaluate and improve site security. Federal statutes already mandate facility assessments of chemical hazards and planning to prevent, mitigate, and respond to accidental releases of hazardous chemicals. And the events of September 11, 2001, undoubtedly have reinvigorated implementation efforts by federal, state, and local government officials, as well as facility operators. Some state and local governments have instituted additional security requirements. For example, Baltimore, Maryland, requires chemical facilities to implement security measures described by police and fire officials. Moreover, trade associations have developed vulnerability assessment methodologies to facilitate planning for diverse types of facilities. The ACC requires that its members assess vulnerability and devise plans to improve security.

The establishment of DHS and Homeland Security Presidential Directive 7 on the protection of critical infrastructure, as well as the newly enacted P.L. 109-295 , ensure a federal role in chemical facility security planning. DHS must identify and prioritize facilities needing protection from terrorists, require vulnerability assessment and security planning, and oversee compliance with security plans at high-risk facilities. However, the DHS authority is limited to three years, which may not be adequate.

Collect Additional Information

Another option would be to delay addressing chemical facility security until additional information is gathered on which to base proposals. The final DOJ assessment of chemical site security and the impact of the current risk management planning program might provide needed insights. For a broader view of the issue, including analysis of policy options, Congress might establish a Blue Ribbon Panel or request a study by the National Academy of Sciences. Studies could provide information about the risks of terrorism, the risks of accidents, the views of public interest groups, and the effectiveness of public disclosure to reduce risks. Such information might assist Congress in evaluating alternative approaches to reducing risks. However, the benefits gained from delaying federal decisions pending development of better risk information should be weighed against the possibility that terrorists might strike this kind of facility before Congress acts.

Improve EPA Guidance and Enforcement

Congress also might provide additional resources for, or exercise increased oversight over, implementation of existing statutes. Although neither EPCRA nor the CAA explicitly addresses chemical releases due to criminal or terrorist acts, EPA arguably has sufficient authority under the acts to more strongly encourage facilities to reduce their vulnerability to terrorists. Additional resources could facilitate EPA review of facility risk management plans. Through September 2001, EPA had reviewed only 15% of submitted plans, according to a GAO report.

As previously mentioned, EPA already has provided guidance to facilities on this subject, but many public interest groups would like EPA to go farther in interpreting the risk management planning requirements of the CAA Section 112(r). For example, US PIRG argued in a 1998 report:

EPA missed opportunities to require companies to identify inherently safer technologies, and ignored comments made by a coalition of environmental and labor organizations calling for a requirement that companies undertake Technology Options analyses to identify inherently safer technologies.

In lieu of regulations, EPA could be urged to provide technical assistance or demonstration programs, or to develop incentives to encourage risk reduction.

EPA has considered revisions to either the risk management planning rule or EPA guidance under the CAA Section 112(r)(7) to require or encourage chemical facility owners to assess their vulnerability to terrorists and correct any significant weaknesses. Some EPA officials expected new principles for risk management planning to address both site and computer security; building access; background checks; inventory controls; storage safety; and other physical security measures, as well as changes that improve "inherent safety."

However, EPA has stated that its authority to regulate chemical site security is unclear, and authority under the Clean Air Act has been questioned by the House Committee on Energy and Commerce. In October 2002, Administrator Whitman announced that EPA would not pursue chemical security regulations under the CAA. President Bush has made it clear that he does not envision a large role for EPA with respect to security from terrorism. Congress might ultimately elect to clarify EPA authority through legislation, expanding or narrowing current interpretations, or examine the adequacy of EPA's implementation of the risk management planning rule in congressional hearings.

A potential disadvantage of relying on existing environmental law is that it may not apply to all facilities of interest. For example, the CAA, Section 112 applies to chemicals that were selected based on severity of potential acute adverse health effects, the likelihood of accidental releases, and the potential magnitude of human exposure. It excludes explosives, as well as flammable substances when used as a fuel, or held for sale as a fuel at a retail facility.

Congressional oversight and guidance for DHS implementation of the newly enacted provisions of P.L. 109-295 also is an option.

Reduce Risk Through Legislation

GAO has recommended that DHS and EPA, in consultation with the Office of Homeland Security, jointly develop a comprehensive national chemical security strategy, which should include a legislative proposal "to require chemical facilities to expeditiously assess their vulnerability to terrorist attacks and, where necessary, require these facilities to take corrective action." DHS and EPA agree. The National Strategy for the Physical Protection of Critical Infrastructures and Key Assets asks DHS to work with Congress to enact such legislation.

If Congress decides that legislation is required to reduce the risks of terrorism targeting chemical plants, proposals might focus on preventing terrorism in general or on reducing risks of terrorism specifically targeting chemical plants. A broad focus on reducing terrorism would involve numerous issues that are beyond the scope of this report. Interested readers are referred to CRS Report RL33600, International Terrorism: Threat,Â Policy,Â andÂ Response , by [author name scrubbed].

A narrower focus on chemical plants might provide incentives for voluntary private sector initiatives or new regulatory authorities to reduce risks. Economists Robert Litan and Peter Orszag have suggested that a blended approach involving performance-based regulation and a requirement for insurance coverage against terrorist acts might be the most cost-effective approach. Stakeholder views regarding the relative merits of voluntary versus mandatory approaches are discussed in the next major section of this report, " Key Issues ," in the subsection on " Responsibility and Accountability ." Bills considered and enacted during the 109 th Congress are described in the last major section of this report, Legislation in the 109 th Congress.

The remainder of the present discussion analyzes selected strategies and tactics for reducing risks that may be incorporated into legislation.

Physical Security Enhancement

Perhaps the most common approach to improving site security is to "harden" defenses so that sites would be less vulnerable to terrorists. According to the recently released DOJ vulnerability assessment methodology, an effective protection system serves three functions: detection (discovery or sensing of adversary action), delay (impediment to adversary progress), and response by security personnel to ensure that a threat is neutralized. Examples of hardening tactics include increasing security patrols, strengthening fences, installing better locks on doors, relocating sensitive chemical processes within the facility, installing intruder detection systems and alarms, and performing background checks on employees. Congress has adopted such tactics in other contexts. For example, the USA Patriot Act ( P.L. 107-56 ) requires background checks as a condition for obtaining a license to operate a motor vehicle transporting a hazardous material in commerce.

A key advantage of hardening tactics is their variety and adaptability to a range of security needs. Other advantages include the ability to deepen defenses by adding layers of protection and, in many cases, relatively low costs. A potential weakness of this strategy is that even the most effective security measures might be disabled or overwhelmed by a determined, skilled terrorist organization. For example, guards might be bribed or killed, passwords discovered, alarms short-circuited, or computers hacked. The World Trade Center and Pentagon attacks demonstrate the vulnerability of any site to a novel and vigorous attack.

Technology Assessment and Inherently Safer Options

An alternative strategy for reducing risk is advocated by environmental groups. It would reduce the hazardous characteristics of the facility, for example, by reducing production, processing, storage, and use of dangerous chemicals, or changing the characteristics of chemicals to make them less dangerous (e.g., by reducing volatility). Such tactics aim to improve the "inherent safety" of a site, and are preferred by advocates to target-hardening tactics, which they often refer to as "add-on safety systems." According to this view, "'Inherent Safety' activities reduce or eliminate the possibility of an accident occurring through the fundamental redesign of production systems or products, reductions in chemical inventories, or substitution for hazardous chemicals at the facility." Currently, there is no federal U.S. law that explicitly promotes use of inherently safer technologies (IST) by the chemical industry.

Two potential advantages of this approach are that consequences of terrorism may be reduced even if a terrorist succeeds in his mission, and that risks associated with accidental releases of chemicals also are likely to be reduced. In addition, efforts to promote inherent safety of production could fill gaps in current laws, which address risks associated with specified chemicals and industries. According to the U.S. Chemical Safety and Hazard Investigation Board, many reactive chemicals responsible for industrial accidents are not covered by the CAA Section 112.

The chemical industry developed the concept of inherent safety, and the ACC Security Code requires members to "consider" it in choosing security measures. Many facility operators have applied this approach in recent years. For example, a utility in Ohio chose to employ a urea-based pollution control system instead of another system which would have required storage of large quantities of ammonia. Shortly after September 11, the Blue Plains wastewater treatment facility in Washington D.C. stopped using chlorine in favor of the less volatile sodium hypochlorite bleach. Other water and wastewater treatment plants are making similar changes in chemical usage.

The key disadvantages of this "safer" facility strategy are potentially higher production and research and development costs, delays in achieving security while new processes are put into place, and, at least in some cases, lack of feasibility. However, advocates argue that use of safer technologies may reduce production costs by reducing regulatory burdens, insurance premiums, transportation costs, and waste disposal costs. Another potential disadvantage of the strategy is that some "safer" tactics may simply spread a risk around, shift the risk to other locations or populations, or substitute one risk for another. For example, in replacing an acutely toxic chemical (that produces relatively severe health effects after a short exposure) with a less acutely toxic chemical, one might increase chronic risks (due to low-level, long-term exposures) or environmental risks (e.g., due to the chemical's persistence).

Deterrence

A third approach to reducing risks aims to reduce theft, rather than direct attacks, by making dangerous chemicals in use at a facility less attractive to criminals, for example, by introducing a color or other property that facilitates detection and tracking by authorities (so-called "taggants"), or by creating and storing antidotes to toxic effects. A disadvantage of the use of taggants is that they act as contaminants, and therefore may impede chemical processes. For this reason, taggants typically are useful only in end products, not in intermediate (i.e., process) chemicals. Generally, such deterrents appear to be in the development stage and are not available for immediate application.

Restricted Access to Information

Restricting terrorists' access to information about vulnerability and location of chemical facilities also might reduce the risk of terrorism. This approach was taken by the 106 th Congress when it enacted amendments to the CAA Section 112(r) to prevent Internet posting of risk management plans and worst-case scenarios for accidents. Internet access to information is a particular concern, because it permits anonymous inquiries about sensitive U.S. facilities from remote locations. P.L. 107-296 , that established DHS, limits access to sensitive information potentially useful to terrorists by exempting information about critical infrastructures submitted voluntarily to DHS from disclosure requirements of the Freedom of Information Act (FOIA).

A key advantage of restricting access to sensitive information is that it is an inexpensive method of reducing risk. However, some argue that information restriction is contrary to American values, reduces public oversight of chemical facilities and consequently facility operators' incentives to reduce risk, and is not likely to prevent determined terrorist groups from obtaining needed information.

The general issue of public access to facility-specific information is discussed under Key Issues, in the section on Public Disclosure.

Key Issues

Policy makers choosing among policy options for reducing terrorist risks associated with chemical plants are faced with at least three fundamentally political issues: the effect of public disclosure; the relative importance of diverse risks (and associated costs and benefits of risk reduction), and who should be responsible (and held accountable) for achieving results.

Public Disclosure

Public disclosure of information about chemical hazards and risk management plans at industrial facilities is controversial. Professional and trade groups representing the chemical industry oppose the release of information regarding the vulnerability of facilities to terrorism and the potential off-site consequences (OCA) to public health and the environment. They argue that terrorists might use the information to target facilities that are most vulnerable or located near large population centers. Congress responded to this view when it enacted amendments to the CAA Section 112(r) in 1999.

Environmental and right-to-know advocates often oppose restrictions on public disclosure. They argue that communities have a right to be informed about hazards to which they might be exposed, and that free access to information is important to ensure public accountability of facility managers. Opponents of limiting public information also point out that citizens need information to assess facility compliance with laws, and if necessary, to petition the Administration or the courts for enforcement. Unsafe practices and inadequate risk management plans, in particular, should be publicized, they contend, so that communities may exert political or social pressure on plant managers to improve the inherent safety of their facilities. Moreover, these groups want access to information about similar facilities handling comparable chemicals across the United States, so that plans and accident rates can be compared and analyzed to determine the effectiveness of various safety measures. Informed citizens can work with local plant managers to reduce the risk of accidents, they argue. This view was adopted by Congress in the 1990 amendments to the CAA Section 112(r).

Another argument in favor of public disclosure has been advanced by investment groups, who argue, "Investors need to know about potential liabilities of companies in which they invest." Although some have argued that environmental information is inadequately disclosed, due in part to vague disclosure requirements established by the Securities and Exchange Commission (SEC), the GAO reported in 2004 that the situation is not clear. GAO found: (1) "Key stakeholders disagree" about how well SEC has defined the environmental disclosure requirements; (2) "Little is known about the extent to which companies are disclosing" such information in their filings with SEC; and (3) SEC enforcement of environmental disclosure requirements may or may not be adequate.

With respect to the possibility that information may be used by terrorists, right-to-know advocates claim that public disclosure of chemical hazards motivates facility operators to reduce chemical hazards, thereby reducing the likelihood and severity of harm from terrorist attacks, as well as the risk of chemical accidents.

The net effect on risk to public health and the environment of public disclosure, therefore, appears to depend on the relative risks of releases due to accidents, versus those due to terrorism, and on the extent to which those risks are reduced or enhanced by publication of risk management plans and similar information. However, data are not available to calculate risks, relative risks, or risk reduction/enhancement potential.

A related issue is the extent to which federal laws regarding public disclosure should preempt state and local disclosure laws. P.L. 107-296 , establishing DHS, prohibits release under the authority of state and local disclosure laws of "information (including the identity of the submitting person or entity) that is voluntarily submitted to a covered Federal agency for use by that agency regarding the security of critical infrastructure and protected systems." For more on issues related to information disclosure, see CRS Report RL31547, Critical Infrastructure Information Disclosure and Homeland Security , by [author name scrubbed] and [author name scrubbed].

Relative Risks

Another important issue involves the diverse and sometimes conflicting goals implicit in discussions of chemical site security enhancement; there is general agreement that risks should be reduced and that "the greatest risks" should be addressed first, but little discussion of which risks are "greatest" and should be targeted and at what cost. For example, should we focus on lowering death rates or rates of sickness and disability? Should we focus on preventive measures or emergency response and recovery services? Should we allocate resources to prevent worst-case scenarios, or everyday risks that add up over time? Are risks due to chemical terrorism worse than risks of equal or greater magnitude due to explosions or firearms? Should we emphasize measures to reduce terrorist risks that also may improve federal efforts to prepare for and respond to other disasters, as the President's National Strategy suggests? To what extent are we willing to sacrifice access to information about facilities in our neighborhoods, privacy, or government accountability for the sake of risk reduction? Are we willing to shift federal resources to DHS and away from other programs? The answers to such questions depend on value judgments and are likely to lead to diverse policy approaches and decisions about particular federal initiatives to reduce the threat of terrorism.

For example, on the one hand, it often is argued that federal expenditures are most efficient when they are allocated with respect to relative risks and risk reduction opportunities. According to this view, relatively more federal funding should be provided to programs targeting risks that are greater and more clearly documented (e.g., to prevent smoking or motor vehicle accidents), than for programs targeting small, hypothetical risks (e.g., from exposure to pesticide residues on food). Based on this reasoning, the risks of chemical terrorism in the United States would deserve relatively few resources, because they are hypothetical and very small. This is especially true for individual chemical facilities. Such reasoning might leave some chemical facilities vulnerable to attack. As explained by the President of the Louisiana Chemical Association, "Worst-case scenarios are just that Virtually every safety system in every process would have to fail for a worst-case scenario to actually happen." Will the federal government or some plant operators find such a scenario incredible, and thus, not worth additional security investments? What cost is justified for risk reduction at individual chemical facilities?

On the other hand, some have argued that the distribution of risk is more important than the absolute or relative magnitude of risk. Scholars at the Brookings Institution, for example, argue that federal resources to combat terrorism should be devoted primarily to avoiding or mitigating potentially catastrophic terrorist acts. Catastrophic events, in which many people are killed or injured at once often strain local social, political, and economic systems, as well as emergency response resources, as was well illustrated by the attack on the World Trade Center and again during the hurricane season of 2005. Thus, the Brookings report focuses on protecting against nuclear, chemical, or biological terrorism and large-scale attacks at airports, seaports, nuclear and chemical facilities, stadiums, big commercial buildings, monuments, and American icons, as opposed to preventing numerous smaller attacks that might produce an equal number of casualties over a longer period of time.

President Bush has directed the DHS Secretary to set priorities for critical infrastructure protection "with an emphasis on critical infrastructure and key resources that could be exploited to cause catastrophic health effects or mass casualties comparable to those from the use of a weapon of mass destruction," but with consideration of numerous other potential effects of terrorist acts. As a result, DHS has been developing a vulnerability-assessment tool, working its way through, "in priority order, first with the nuclear energy sector, and with the chemical sector, and shortly to follow many others across the top tier of consequences, vulnerabilities and threats."

Still others object to reliance on any form of cost-benefit accounting with respect to public health and environmental risk management, because quantitative, analytic tools often do not consider risk factors and management options that they consider important. For example, one cannot produce a reliable estimate of benefits that might accrue from basing decisions on the so-called "precautionary principle" or most other preventive management tools, because specific kinds of damages and clean-up costs may never occur, and thus cannot be validated or corrected. Moreover, it can be argued that quantitative analysis is biased against preventive measures, because the hypothetical benefits, as well as the hypothetical risks, accrue (or not) in the future and generally are discounted (reduced in value). Many observers feel this kind of process inevitably estimates that preventive options will have relatively high short-term costs and relatively low and uncertain long-term benefits.

Responsibility and Accountability

Deciding who should be responsible for achieving results (or who should be held accountable) requires consideration of many factors, including statutory authority, resource availability, technical competence, political feasibility, and moral or ethical constraints. Responsibility is multifaceted, involving financial, operational, and managerial duties, and may be layered hierarchically. In addition, responsibility may be shared or distributed among several private and public entities. For example, in the case of chemical plant safety, responsibility probably will be divided in some manner to include owners/operators of facilities, insurers, and some unit of government. It is up to policy makers to decide upon the appropriate distribution of each component.

Generally, people agree that the federal government is responsible for protecting citizens and the homeland, and that business owners are responsible for not causing hazards for their employees, neighbors, and assets. However, people have different views about who should be held accountable for the consequences of an act of terrorism, what level of protection from risk is acceptable, whether the private sector is likely to achieve that level of protection without public assistance or oversight, and who should bear the costs of achieving greater safety. These different views largely reflect general political philosophies (e.g., regarding the appropriate role of government and the value of public involvement in risk management decisions), but they also are influenced by specific knowledge of, and attitudes toward, the chemical industry, EPA, and other governmental and non-governmental entities.

Some argue that the risks of terrorism for individual chemical facilities are so small that many facility managers are unlikely to invest sufficient resources to adequately ensure site security. Based on this view, some argue that sufficient reductions in terrorist risks for the nation as a whole can be assured only if chemical facilities are required to comply with federal standards for risk managementâthat is, if they are held accountable by government. Federally mandated standards are likely to ensure a greater level of safety, according to this view, because administrative rule-making procedures provide for public comments, including comments by people potentially at risk if a terrorist attacks, but who do not directly profit from neighboring facilities. Voluntary chemical site security measures advocated by trade associations do not suffice, it is argued, because they do not cover all potentially dangerous facilities and have no standards, no timelines, no hazard reduction policies, no measurable hazard reduction goals, no accountability, and are not enforceable. However, at least some trade associations require independent audits of risk management plans, as discussed below.

Recent testimony by Robert Stephan, Assistant Secretary of Infrastructure Protection, indicates that approximately 20% of chemical facilities that are relatively hazardous are not voluntarily signed up to an industry security code and are not covered by MTSA. As a result, DHS does not know whether they are acting to secure themselves from terrorist acts.

Some contend that chemical facility operators are willing and prepared to reduce significant risks, for personal, professional, and business reasons. They argue that well-managed businesses routinely assess, prioritize, and manage risks of all kinds, including risks of potential exposure to hazardous chemicals due to criminal or terrorist acts. Business incentives to good chemical risk management include reduced legal liability, reduced insurance costs, enhanced reputation, improved employee relations, and reduced costs for remediation and victim compensation. In the United States, environmental and occupational health and safety laws provide additional incentives to many facility operators to responsibly manage hazardous chemicals.

Some are opposed to new legislation, because it might disrupt and delay installation of security enhancements by individual companies. On the other hand, such legislation could benefit businesses by shifting liability to the government and discouraging states from adopting diverse regulatory strategies.

Some industry representatives, while acknowledging that some guidance, training, and financial assistance for threat assessment and risk management are needed, especially for addressing risks to small businesses, point out that trade associations and industrial research centers have been working for several years to fill such needs. Such groups advocate a flexible, risk-based approach to securing facilities, arguing that "most plants are not likely terrorist targets." Some business groups argue that most regulations inappropriately force diverse enterprises to adopt a "one-size-fits-all" strategy. To satisfy any public demand for assurance that risk reduction is occurring, some industry representatives have recommended a safety certification process and are willing to submit their facilities to independent audits.

In the National Strategy for the Physical Protection of Critical Infrastructures and Key Assets , released in February 2003, the Bush Administration recommended legislation to enhance security measures at chemical facilities, although it had hoped to avoid that approach, according to the Secretary of the Department of Homeland Security, Tom Ridge. He acknowledged that the Administration (as of mid-July 2002) had been leaning toward a voluntary approach. The Administration would assign financial responsibility to chemical facility owners. According to Ridge, "[T]his is a cost [chemical companies] have to absorb." For their part, some pesticide trade groups would welcome increased government assistance in the form of funding for education.

Administrative support for legislation again was expressed at a Senate hearing June 15, 2005. Although this was interpreted by many news reports as a change in Administration policy, Robert B. Stephan, Acting Undersecretary of DHS for Information Analysis and Infrastructure Protection, testified that there has been no change in the Administration's position: It has always been willing to work with Congress to produce new regulatory authority to enhance the security of chemical facilities. However, the Undersecretary emphasized that the Administration will only support risk-based regulation of chemical security. Mr. Stephan stated that DHS was not quite ready to propose or approve of any particular legislative provisions, but would be in a position to do so soon.

The 109 th Congress ultimately decided that the private sector should be held accountable and enacted legislation ( P.L. 109-295 ) authorizing DHS to oversee facility vulnerability studies and set performance standards for facility risk management. The American Chemistry Council and the Administration support the enacted legislation. Others in the 109 th Congress would have preferred legislation ( H.R. 2237 ) that would have would have required submission of assessments and plans to EPA. Many would have preferred S. 2145 / H.R. 4999 or H.R. 5695 , which were more comprehensive and addressed controversial issues such as federal preemption of state and local laws and whether to require consideration or implementation of inherently safer technology.

Legislation in the 109th Congress

Although legislation to enhance the security of a broad range of chemical facilities was introduced in previous Congresses (the 107 th and 108 th ), none was enacted. A shift in committee structure in both the House and the Senate may have affected the fate of legislation in the 109 th Congress. The Committee on Homeland Security and Governmental Affairs took the lead in holding hearings and developing legislation in the Senate. However, Senator Inhofe, Chairman of the Senate Committee on Environment and Public Works, which held hearings during the previous Congress, placed a hold on the bill because of concerns about its coverage of drinking water and wastewater treatment facilities (which fall within the purview of his committee). In the House, bills were referred to both the Committee on Energy and Commerce, which held hearings during the 108 th Congress, and to the now permanent Committee on Homeland Security, which reported a bill very similar to the Senate bill. As the 109 th Congress approached the end of the 2 nd session, the Chairman of the Committee on Energy and Commerce supported an amendment to the DHS FY2007 appropriations bill, H.R. 5441 , which was adopted and became law when the bill was enacted on October 4, 2006. On December 5, 2006, the Chairman introduced the same provisions as a stand-alone bill, H.R. 6348 . P.L. 109-295 provides authority to DHS for three years to issue regulations for high-risk chemical facilities, other than drinking water and wastewater treatment facilities and facilities in ports. The enacted provisions combine certain elements of H.R. 5695 , as reported by the House Homeland Security Committee, and S. 2145 , as reported by the Senate Committee on Homeland Security and Governmental Affairs. The various legislative proposals, as well as the enacted provisions, are summarized below.

S. 2145/H.R. 4999

Senator Collins, Chairman of the Homeland Security and Governmental Affairs Committee (HSGAC), introduced S. 2145 , the Chemical Facility Anti-Terrorism Act, in December 2005, after holding four hearings to frame the problem and possible solutions. The bill was co-sponsored by Senator Lieberman, Ranking Member of the HSGAC. Congressmen Shays and Langevin introduced a companion bill, H.R. 4999 , in the House on March 16, 2006. The HSGAC amended and approved S. 2145 on June 15, 2006. The bill was reported on September 11, 2006.

S. 2145 would direct the Secretary of DHS to promulgate rules for designating chemical sources for regulation, assigning sources to various risk-based tiers, and establishing performance-based security standards for each tier. Facilities would be considered for listing (i.e., designation) if they produced, used, or stored a substance of concern in a quantity equal to or greater than a threshold quantity. Substances of concern would be those that trigger risk management planning requirements under the Clean Air Act, Section 112(r), as well as ammonium nitrate and any other substance designated by the Secretary, based on the potential extent of death, injury, or serious adverse effects to human health and safety or the environment or the potential impact on national or economic security or critical infrastructure caused by a terrorist incident. Designated facilities would be assigned to risk-based tiers and required to complete and submit to DHS vulnerability assessments, security plans, and emergency response plans for terrorist incidents. DHS would be required to review these submissions. For facilities in the higher risk tiers, S. 2145 would require a written DHS determination to approve, disapprove, or modify facility assessments and plans within 21 months of the date of enactment (within nine months of the date when DHS issues regulations concerning assessments and plans).

S. 2145 would establish a duty to report to DHS for facilities handling more than a threshold quantity of a designated substance of concern, and it would require plans to specify "steps taken by the chemical source to coordinate security measures and plans for response to a terrorist incident with Federal, State, and local government officials, including law enforcement and first responders." Plans would have to be "sufficient to deter, to the maximum extent practicable, a terrorist incident or a substantial threat of such an incident," and "include security measures to mitigate the consequences of a terrorist incident."

S. 2145 would provide administrative, civil, and criminal penalties for facility owners or operators who failed to submit assessments or plans or to implement plans adequately. DHS would be authorized to issue an order for the chemical source to cease operation if the facility persisted in noncompliance with the requirements established under S. 2145 .

Other S. 2145 provisions would require reports from DHS and GAO, establish a process by which any person may submit a report to DHS regarding vulnerabilities of a chemical source, and protect whistle-blowers from retaliation. The bill would mandate coordination with existing security and emergency response planning, including planning under MTSA. To that end, S. 2145 establishes regional security offices and area security committees and plans. State and local laws would not be preempted unless they were in "actual conflict" with the federal law.

With respect to information protection, S. 2145 would prohibit DHS and other federal, state, and local agencies from releasing to the public vulnerability assessments, site security plans, security addenda to emergency response plans, area security plans, or materials developed or produced exclusively in preparation for assessments or plans. The introduced bill would have required public disclosure of written certifications of compliance by facility owners/operators, DHS certificates of compliance issued for individual sources, DHS orders issued for noncompliance, and lists of facilities for which DHS has issued an approval or disapproval, unless the Secretary determined that release of a particular record would increase security risk. This provision was modified during markup. As reported, S. 2145 would prohibit disclosure of such documents and would permit disclosure of certifications only if DHS determined that release would not increase security risk.

S. 2145 also was modified with respect to judicial review of agency action. As introduced, the bill was silent, so that all final agency actions would have been subject to judicial review under the provisions of the generally applicable Administrative Procedure Act (5 U.S. C. Â§701 et seq.). However, S. 2145 , as reported, distinguishes between rulemaking and other final agency actions with respect to courts of jurisdiction, as well as parties authorized to act. S. 2145 would allow challenges to final rules only in the U.S. Court of Appeals for the District of Columbia, whereas challenges to any other final actions could be filed in district courts. In addition, S. 2145 , as reported, would authorize any person to file a petition for judicial review of a final regulation, but would authorize only the owner or operator of a chemical source to file a petition for review of a final agency action or order. Only that owner or operator and the Secretary would be authorized to participate in such civil action.

S. 2486

Senator Lautenberg introduced the Chemical Security and Safety Act of 2006 ( S. 2486 ) on March 30, 2006. On introduction, the bill was co-sponsored by Senators Biden, Durbin, Kerry, Menendez, and Obama. The bill addresses security and safety at "stationary sources," which are facilities covered by the CAA Section 112(r)(2) and other facilities that the DHS Secretary designates as "high priority" that produce, process, handle, or store any "substance of concern." Substances of concern are defined as substances listed under the CAA Section 112(r)(3) in a threshold quantity or any other substance designated by the Secretary.

For all stationary sources, S. 2486 would establish a general duty toâ

identify hazards that may result from a criminal release of a substance; ensure that the facility is designed, operated, and maintained in a safe manner; and reduce the consequences of a criminal release.

Owners or operators would be required to involve employees in ensuring the "design, operation, and maintenance of safe facilities," an obligation that includes "to the maximum extent practicable" use of inherently safer technology (IST). IST is defined as the "use of a technology, product, raw material, or practice that, as compared to the technology, products, raw materials, or practices currently in use," "significantly reduces or eliminates the possibility of the release of a substance of concern, and" "significantly reduces or eliminates the hazards to public health and safety and the environment associated with the release or potential release." This definition includes such actions as "chemical substitution, process redesign, product reformulation, and procedural and technological modification."

The DHS Secretary, in consultation with the EPA Administrator, would be directed to designate by rule at least 3,000 facilities handling substances of concern as "high priority categories," based on potential severity of harm; proximity to population centers; threats to national security; threats to critical infrastructure; threshold quantities of substances of concern that pose a serious threat; and other safety or security factors that the DHS Secretary, in consultation with the EPA Administrator, determines to be appropriate. S. 2486 also would require the Secretary to identify the 600 highest priority stationary sources.

Each owner or operator of these high-priority facilities would be required to submit to DHS a written report that would include a vulnerability assessment, an assessment of the hazards, and a prevention, preparedness, and response plan that would incorporate the results of the assessments and meet requirements established by DHS. Each plan would have to include discussion of the practicability of implementing each element of "safe" facility design, operation, and maintenance. The bill also requires consultation with employees at the facility in developing the assessments and plan.

S. 2486 requires the DHS Secretary to review each report submitted to determine whether it complies with DHS regulations, and to certify approval for compliant facilities. In addition, the bill directs the DHS Secretary to notify any owner or operator who submits a plan that is disapproved. S. 2486 would establish an information clearinghouse to assist facilities in complying with requirements.

S. 2486 would provide administrative, civil, and criminal penalties for facility owners or operators who failed to comply with a compliance order or directive issued by the Secretary. If a threat of a terrorist attack is beyond the scope of a submitted prevention, preparedness, and response plan, or if current implementation of the plan is insufficient, DHS would be authorized to issue a compliance order. If a facility persisted in noncompliance, the Secretary would be authorized, after notifying the facility of that fact, to seek judicial relief to abate the threat. Such judicial relief could include an order to cease operation and such other orders as would be necessary to protect public health or welfare.

The bill mandates annual employee training at all stationary sources with respect to the Act's requirements. At stationary sources with at least 15 employees, S. 2486 would establish Employees' Safety and Security Committees to identify, discuss, and make recommendations to owners or operators concerning potential hazards and risks relevant to security, safety, health, and the environment. These committees are to participate in developing, reviewing, and revising vulnerability assessments, hazard assessments, and prevention, preparedness, and response plans at their facilities. In addition, the bill would require notification and involvement of employees in facility inspections and investigations.

S. 2486 provides extensive and detailed protection for whistle-blowers who might report problems at their facilities to authorities. Penalties for employers who do not comply with worker protections increase with repeated violations.

S. 2486 does not require owners or operators of chemical sources to notify DHS when there are changes affecting the source's security. However, the bill does require updates for vulnerability assessments and security plans on a regular basis.

S. 2486 mandates coordination of implementation of requirements with the Maritime Transportation Security Act of 2004 (MTSA; P.L. 108-293 ) and requires that the DHS Secretary minimize duplication of the requirements for risk assessment and response plans under other federal law.

S. 2486 would protect DHS from public disclosure requirements under the federal Freedom of Information Act for "all documents provided to the DHS Secretary under this Act, and all information that describes a specific vulnerability or stationary source derived from those documents," with a few exceptions, such as compliance certifications by the DHS Secretary. No similar protection is provided for information at other federal agencies, but state and local government agencies are protected from disclosure requirements of all federal, state, and local laws. S. 2486 does not authorize penalties for disclosure of protected information by federal employees.

H.R. 5695

On June 28, 2006, Representative Daniel E. Lungren, Chairman of the House Subcommittee on Economic Security, Infrastructure Protection, and Cybersecurity, Committee on Homeland Security, introduced H.R. 5695 . The Subcommittee held a hearing on the bill June 29, 2006, and approved it, amended, July 11, 2006. On September 29, 2006, the House Homeland Security Committee reported an amended version of the bill, and the House Committee on Energy and Commerce was granted an extension until November 17, 2006, of its referral for consideration of the bill. Similar in many ways to S. 2145 , H.R. 5695 is described as more "streamlined," but it also includes provisions not in S. 2145 .

H.R. 5695 , as reported, would amend the Homeland Security Act of 2002 (6 U.S.C. 101 et seq.) by adding at the end a new title. It would authorize the Secretary of Homeland Security to designate chemical substances of concern and threshold quantities for regulation. In designating or exempting substances and setting threshold quantities, the Secretary would be required to consider "the potential extent of death, injury, or serious adverse effects to human health, the environment, critical infrastructure, national security, the national economy, or public welfare that would result from a terrorist release of the chemical substance."

The Secretary would be required to keep a list of chemical facilities that have more than the threshold quantity of any substance of concern, as well as other facilities the Secretary may choose to designate "significant." Each selected facility would have to be assigned to one of at least four risk-based tiers.

H.R. 5695 would require the Secretary, within a year of enactment, to prescribe regulations to establish standards, protocols, and procedures for vulnerability assessments and facility security plans that might be required for listed facilities. Regulations must be risk-based and performance-based and must take into consideration, among other factors, the cost and technical feasibility of compliance. H.R. 5695 also requires the Secretary to establish security performance requirements for security plans in each tier.

The bill requires the owner or operator of a facility assigned to the high-risk tier to conduct a vulnerability assessment and to prepare and implement a facility security plan. Owners or operators or high-risk facilities must submit assessments and plans within six months of the date on which regulations are prescribed. H.R. 5695 would exempt facilities subject to the Public Health Security and Bioterrorism Preparedness and Response Act or the MTSA from additional requirements for submitting vulnerability assessments and security plans to DHS, unless the Secretary finds that the facility requires more stringent security measures.

The DHS Secretary, or a designated third-party entity, would be directed to review and approve or disapprove plans and assessments for facilities within 180 days of receiving such documents. The Secretary would be required to disapprove an assessment or plan if it did not comply with regulations or was insufficient to address vulnerabilities identified in the assessment or a threat to the facility. As reported, H.R. 5695 would allow the DHS Secretary to require a high-risk facility to use inherently safer technology (IST), if the Secretary determined that incorporation of IST into the facility would significantly reduce the consequences of terrorist actions, would be feasible, and would not significantly impair the ability of the owner to continue in business. Written notice of disapproval of a security plan must be provided to an owner or operator. The bill explicitly denies any private right of action against an owner or operator to enforce any provision of the Act. A facility owner or operator would have the right to appeal to a chemical security review board a decision of the Secretary with respect to the use of IST.

H.R. 5695 would establish a process by which any person might report problems or vulnerabilities at a chemical facility, and for employees, the bill provides protection against retaliation by the employer.

Administrative, civil, and criminal penalties for noncompliance with the provisions of this law would be authorized. A chemical facility owner or operator would have the right to a formal hearing to dispute a penalty for a violation. State and local laws would not be preempted by the law, unless they "may frustrate the purposes of this title or any regulations or standards prescribed under this title." As amended, the bill would specify that it did not prevent a state from enacting or enforcing a law or regulation related to environmental protection, health, or safety.

The bill directs the Secretary to prevent disclosure of protected information by any federal agency under FOIA or under any state or local law. Protected information would include the criteria and data used to assign facilities to risk-based tiers and the tier assignments for specific facilities, vulnerability assessments, facility security plans, assessments of IST, security performance requirements for a facility, and any other information generated or collected by a government agency or a chemical facility to fulfill requirements of this title if it describes any vulnerability, describes the assignment of a facility to a risk-based tier, describes a security measure for the protection of a chemical facility from terrorism, or if "the disclosure of which the Secretary determines would be detrimental to the security of any chemical facility."

H.R. 5695 also establishes a procedure for certifying third-party auditors under the Homeland Security Act, Section 863-864. As reported, the bill includes provisions to reduce the potential for a conflict of interest for auditors.

As reported, H.R. 5695 would establish an Office of Chemical Facility Security at DHS.

H.R. 5441/H.R. 6348

As the 109 th Congress drew to a close, the Senate and House passed the DHS appropriations bill for 2007, H.R. 5441 , which included certain provisions found in H.R. 5695 , as reported by the House Committee on Homeland Security, and S. 2145 , as reported by the Senate Committee on Homeland Security and Governmental Affairs. The law, P.L. 109-295 , provides authority to DHS for three years to issue regulations for high-risk chemical facilities, other than drinking water and wastewater treatment facilities and facilities in ports. DHS is directed to establish risk-based security performance standards for such facilities, and designated chemical facilities are required to prepare vulnerability assessments and facility security plans. DHS has authority to inspect facilities and order compliance. Failure to comply with an order may be punished with a civil penalty of $25,000. There are no criminal penalties for noncompliance, although criminal penalties are authorized for unauthorized disclosure of "protected information." In the event of repeated compliance failures, DHS may order a facility to cease operations. The law is silent on numerous issues, including the criteria for weighing risks of various facilities, federal preemption of state and local right-to-know laws, how to facilitate congressional oversight, and the role of IST.

H.R. 1562

Two other chemical facility security bills in the House were similar to proposals in the 108 th Congress. H.R. 1562 was introduced by Representative Fossella. It offers an approach somewhat similar to that of S. 994 , as reported in the 108 th Congress. H.R. 1562 would make DHS the lead agency overseeing chemical facility security, but it would require consultation between DHS and EPA. The bill would give the DHS Secretary discretionary authority to select facilities that should conduct vulnerability assessments and security planning, but it would require designation of high-priority facilities. H.R. 1562 would exempt from its requirements drinking water treatment facilities required to conduct vulnerability assessment under the Safe Drinking Water Act and facilities subject to the MTSA, unless the owner or operator of such a facility petitioned the Secretary to be subject to the requirements of this act in lieu of the former act. Vulnerability assessments and plans would be focused in H.R. 1562 on security (i.e., hardening) and emergency measures, in order to prevent and respond to releases caused by terrorism, rather than on inherent safety measures that might reduce the consequences of an unauthorized release, regardless of cause.

H.R. 1562 also would protect from public disclosure under FOIA and state and local disclosure laws the certification documents submitted by facility managers indicating that they have complied with assessment, planning, and implementation requirements. (This is in addition to a provision that protects from public disclosure information related to vulnerability assessments and security plans.) H.R. 1562 also would withhold such information from civil judicial or administrative proceedings (except with respect to compliance with the chemical facility security legislation), thus shielding facility owners from lawsuits based on those documents. Criminal penalties are provided for unauthorized knowing disclosure of protected information by government officials.

H.R. 1562 would authorize DHS to disapprove any assessment or plan and to order revision if it did not comply with regulations, or if the plan or implementation were insufficient to address the results of a vulnerability assessment or a threat of a terrorist release. Civil, but not criminal, penalties would be available if facility owners or operators failed to comply with an administrative order.

H.R. 2237

H.R. 2237 (introduced by Representative Pallone and similar to S. 157 / H.R. 1861 in the 108 th Congress) would build on existing EPA authority to oversee chemical facilities but would require consultation with DHS. It would require EPA to designate "certain combinations of chemical sources and substances of concern" as high priority categories based on the severity of the threat posed by an unauthorized release, proximity to population centers, and other criteria. Owners and operators of facilities within high priority categories would be required to conduct vulnerability assessments, identify hazards, and prepare prevention, preparedness, and response plans to eliminate or significantly lessen the potential consequences of an unauthorized release. Plans would be required to incorporate inherently safer technology, if practicable. Copies of vulnerability assessments and plans would be submitted to EPA and updated periodically.

H.R. 2237 would protect vulnerability assessments and plans from public disclosure under FOIA, but H.R. 2237 would allow disclosure of information under state or local laws, if the state or local government received the information independently of DHS.

H.R. 2237 would direct EPA to review each assessment and plan, determine compliance, and certify that determination. EPA would be authorized to issue compliance orders 30 days after notifying a chemical source that its assessment or plan was inadequate and offering compliance assistance, if the plan was not revised to comply with EPA requirements. If DHS notified a chemical source that its plan or implementation was insufficient to address a threat of terrorist attack, and the chemical source took inadequate action in response to that notice, DHS would be authorized to secure necessary relief to abate the threat from a district court in the district where the threat existed.

Other Legislation

In addition to these comprehensive proposals to enhance the security of chemical facilities, bills have been introduced that address a specific category of facility or chemical. For example, S. 2052 / H.R. 713 would provide a tax credit to agricultural businesses for security enhancements. S. 1995 and S. 2781 address the security of wastewater treatment facilities. S. 2781 was reported by the Senate Committee on Environment and Public Works on September 21, 2006. S. 2855 would require community drinking water and wastewater treatment facilities to replace hazardous gaseous chemicals, such as chlorine gas, with IST. H.R. 3197 / S. 1141 and H.R. 1389 aim to secure supplies of ammonium nitrate, an explosive. H.R. 3197 was approved by the House Homeland Security Committee on June 14, 2006. Some of the provisions of H.R. 3197 / S. 1141 were incorporated as an amendment into S. 2145 on June 15, 2006, by the Senate HSGAC.

On July 14, 2005, the Senate unanimously agreed to an amendment to H.R. 2360 , the Department of Homeland Security Appropriations Act for 2006, expressing the "Sense of the Senate that Congress should pass legislation establishing enforceable federal standards to protect against a terrorist attack on chemical facilities within the United States." The conference report on H.R. 2360 , which became P.L. 109-90 on October 18, 2005, included the same support for legislation and added a requirement for DHS to submit a report to the Appropriations Committees by February 10, 2006, "on the resources needed to implement mandatory security requirements ... and to create a system for auditing and ensuring compliance with the security standards." The conferees also directed the Secretary to complete vulnerability assessments of the highest risk chemical facilities by December 2006 and to complete a national security strategy for the chemical sector by February 10, 2006.

Conclusions

The threat of terrorism in the United States challenges the existing balance maintained in federal laws between the public's right to know about chemical hazards and the chemical industry's right to protect confidential business information. At issue are risks to public health and safety, environmental protection, civil rights and duties, national security, and privacy. Some are advocating a strategy of relative risk analysis and analysis of risk management options to reveal the best course of action. However, information appears to be inadequate for quantitative evaluation of the risks of chemical releases, whether deliberate or accidental, and the nature of terrorism makes prediction difficult. Moreover, there is no universally accepted level of tolerable risk, no obvious basis for a comparison of relative risks and benefits, and no established federal mechanism for ensuring responsible management of the risks of chemical terrorism.

A variety of federal policy options are available for enhancing chemical security. In choosing among options, policy makers face three key issues: how to evaluate the risks versus the benefits of public disclosure; how to determine and prioritize the relative importance of diverse risks; and who to hold responsible for achieving results. Section 550 of P.L. 109-295 , the FY2007 DHS appropriation, resolved these issues temporarily by providing three years of regulatory authority for DHS. The law requires vulnerability assessments for high-risk chemical facilities and implementation of security plans to address hazards revealed in such assessments. Other legislative proposals that were considered by the 109 th Congress would have done the same, but also addressed issues such as how to facilitate congressional oversight of DHS implementation, the role of inherently safer technology, the criteria used to designate facilities as more or less "risky," and whether state and local right-to-know laws should be preempted by the federal provisions. It remains to be seen whether Congress will tackle such issues in the future.

Additional Reading

CRS Report RL31547, Critical Infrastructure Information Disclosure and Homeland Security , by [author name scrubbed] and [author name scrubbed].

CRS Report RL31861, High-Threat Chemical Agents: Characteristics, Effects, and Policy Implications , by [author name scrubbed].

CRS Report RL31542, Homeland Security â Reducing the Vulnerability of Public and Private Information Infrastructures to Terrorism: An Overview , by [author name scrubbed].

CRS Report RL33043, Legislative Approaches to Chemical Facility Security , by [author name scrubbed].

CRS Report RL31294, Safeguarding the Nation ' s Drinking Water: EPA and Congressional Actions , by [author name scrubbed].

CRS Report RL32189, Terrorism and Security Issues Facing the Water Infrastructure Sector , by [author name scrubbed].