Legislative Approaches to Chemical Facility Security
Released: 2006-07-12T00:00:00

Introduction

Federal officials, policy analysts, and homeland security experts express concern about thecurrent state of chemical facility security. Referring to them as "the single greatest danger of apotential terrorist attack in our country today," some experts fear these facilities are at risk of apotentially catastrophic terrorist attack. (1) The Department of Homeland Security (DHS) identifies chemicalfacilities as being one of the highest priority critical infrastructure sectors. (2)

Currently, chemical facility security efforts include a mixture of local, state, and federal laws,industry trade association requirements, voluntary actions, and federal outreach programs. The DHShas identified this composite as being insufficient in addressing security for the entire chemicalssector. Additionally, various costs and requirements may act as disincentives to stakeholdersattempting to create uniform, effective security against terrorist attack.

Many in the public and private sector call for federal legislation to address chemical facilitysecurity. (3) Still,disagreement exists over whether federal legislation is the best approach to securing chemicalfacilities, and, if legislation is deemed necessary, what approaches best meet the security need. Sincethe population potentially affected by a chemical release generally resides near specific facilities,some experts may argue that chemical facility security concerns should be dealt with by state or localauthorities. Other experts claim the potentially catastrophic nature of a terrorist attack and thewidespread distribution of chemical facilities make chemical facility security an issue of nationalconcern. Policymakers may decide that chemical facility security is a matter of national homelandsecurity and is best addressed at the federal, rather than state level.

Critical issues surrounding chemical facility security legislation include determining whichchemical facilities should be protected, which involves analyzing and prioritizing chemical facilitysecurity risks, identifying which chemical facilities pose the most risk, and establishing whatactivities could enhance facility security to an acceptable level. Because of the widespread use ofchemicals in U.S. society, determining which chemical facilities to protect is a challenge. Selectionmight be based on relative risk, but it is not clear how this risk might be determined. Mechanismsfor assessing security risk might include weighing the known or theoretical terrorist threat faced bya particular facility, the chemical hazards held at a facility, the quantities of those chemicals, and thelocation of those chemicals relative to the surrounding population.

Security regulation of some chemical facilities is established under certain statutes, includingthe Maritime Transportation Security Act (MTSA) ( P.L. 107-295 ) and the Safe Drinking Water Act(SDWA), as amended by the Bioterrorism Preparedness Act ( P.L. 107-188 ). Several states haveestablished homeland security statutes and three, New Jersey, Maryland, and New York, have statelaws or regulations specifically addressing chemical facility security. Potential chemical facilitysecurity enhancement might be achieved through a range of policy approaches: providing grants toincrease security at high risk facilities; mandating site vulnerability assessments; compellingvulnerability remediation; establishing federal security standards; or requiring the consideration oruse of specific technologies. Proposed legislation may aim to complement existing law or tooverride it.

In the 109th Congress, legislation has been introduced in both chambers addressing concernsregarding chemical facility security. In the Senate, S. 2145 , the Chemical FacilityAnti-Terrorism Act of 2005, and S. 2486 , Chemical Security and Safety Act of 2006,have been introduced. In the House, H.R. 1562 , the Chemical Facility Security Act of2005, H.R. 2237 , the Chemical Security Act of 2005, H.R. 4999 , acompanion bill to S. 2145, and H.R. 5695 , the Chemical FacilityAnti-Terrorism Act of 2005, have been introduced. Each bill contain provisions requiringvulnerability assessment and the creation of security plans, though details vary significantly betweenthe bills. One area of previous contention involves inclusion of consideration or use of inherentlysafer technologies. S. 2486 and H.R. 2237 both explicitly address inherentlysafer technologies, while S. 2145/H.R. 4999, H.R. 5695 and H.R.1562 do not.

This report will discuss current chemical facility security efforts, considerations in definingchemical facilities, policy challenges in developing chemical facility security legislation, and selectpolicy approaches. For information on the risks of terrorism at chemical facilities, previouslyestablished federal safety requirements, general policy issues, and an overview of legislativeinitiatives in prior Congresses, see CRS Report RL31530 Chemical Facility Security, by Linda-JoSchierow.

Current Efforts To Secure Chemical Facilities

Many organizations are undertaking efforts to secure chemical facilities. Some efforts arevoluntary in nature, involving security best practices, or semi-voluntary, such as requirements formembership in trade associations. Other efforts arise from state or local chemical facility securityregulation. Finally, federal security legislation affecting some chemical facilities was enacted inprevious Congresses. Federal agency outreach activities continue.

Voluntary Efforts

Industry trade associations have developed and publicized security best practices for theirmember companies. (4) These practices vary, but many recommend or require vulnerability assessments of chemicalfacilities, generation of security plans to address the largest vulnerabilities, implementation of thesesecurity plans, and, in some cases, external auditing of these security plans or their implementation. One of the most often discussed trade association security requirements is the American ChemistryCouncil's (ACC) Responsible Care program. (5) The DHS officially recognizes the Responsible Care Security Codeas an Alternative Security Program for the purposes of compliance with MTSA. (6) The ACC companies comprisealmost 90% of basic industrial chemical production, although their members are only a small fractionof the total number of chemical manufacturers. While many other chemical manufacturers anddistributors participate in other trade associations, the DHS testified that approximately 20% of thechemical facilities that DHS identifies as high risk do not participate in any voluntary securityprogram. (7)

Some argue that a voluntary security program is insufficient to meet the risk of a significantterrorist attack. One security expert testified that

... it is a fallacy to think that profit-maximizingcorporations engaged in a trade as inherently dangerous as the manufacture and shipment of TIH[Toxic Inhalation Hazard] chemicals will ever voluntarily provide a level of security that isappropriate given the larger external risk to society as a whole. (8)

Others challenge the voluntary security plans as vague, inappropriately focused on physical security,and difficult to verify. (9) Some analysts likewise believe that current security at chemical facilities would not stop adetermined, armed attacker. (10)

Supporters of voluntary efforts cite the large investment made in site security since 2001 andother efforts to reduce risk as signs of their effectiveness. The ACC, for example, notes that itsmember companies invested over $2 billion in security enhancements since 2001. (11) Additionally, somefacilities voluntarily switched chemicals, changed manufacturing processes, or reduced the amountof chemicals on-site. (12) As one industry trade association representative testified, "Our efforts show that industry does notneed to be prodded by government mandates to take aggressive and effective steps to secure itsfacilities." (13)

State Efforts

Several states have safety or environmental laws applying to chemical facilities, but three,New Jersey, Maryland, and New York, have enacted security laws that specifically target chemicalfacilities. Under New Jersey's Domestic Security Preparedness Act of 2001, the New JerseyDomestic Security Preparedness Task Force is authorized to adopt and enforce security standardson the public and private sector, following review and approval by the Governor. (14) In November, 2005, theTask Force mandated chemical facilities to comply with previously voluntary best practices,including reviewing existing processes for inherently safer alternatives at specific facilities. Facilities must report to the New Jersey Department of Environmental Protection. (15)

Under Maryland's Hazardous Material Security Act, facilities that are required to fileEnvironmental Protection Agency (EPA) risk management plans (RMPs) must perform vulnerabilityassessments and implement plans to address those vulnerabilities. The Hazardous Material SecurityAct excludes agricultural fertilizer retailers from this requirement. The facilities must report to theMaryland Department of the Environment and the Maryland State Police. (16)

Under New York's Anti-Terrorism Preparedness Act of 2004, the New York Office ofHomeland Security is charged with reviewing the vulnerability of chemical plants, following whichit can recommend security improvements at particular plants. The Anti-Terrorism Preparedness Actof 2004 also allows the state Office of Homeland Security, in consultation with stakeholders, toidentify chemical facilities covered by the law. It excludes facilities holding fuel for retail sale andfacilities that are water suppliers. The Department of Environmental Conservation enforces thelaw. (17)

Policymakers who believe that states are better suited to assess local threats and vulnerabilities may prefer chemical facility security measures to be developed locally. A potentialconcern of industry about such state laws is that a patchwork of regulations could develop, withdifferent standards applying to facilities located in different states. Consequently, facilities in somestates might be more secure than in others, or a facility's out-of-state competitors might face verydifferent security costs. Policymakers who believe such an approach does not provide sufficientsecurity to the population at large, or places an uneven burden on industry may prefer a nationalstandard. Also, some chemical facilities located near state borders may pose risks across state lines,supporting efforts for a national standard.

Federal Efforts

Congress has passed many environmental and safety statutes which may provide ancillarysecurity benefits. Congress has also enacted legislation providing security requirements for somespecific types of chemical facilities, but these requirements vary among different statutes. Also, thefederal government, through the Department of Homeland Security and other agencies, engages theprivate sector in a public/private partnership, raising the profile of chemical facility security andproviding first responders with federal funding to secure critical infrastructure, including chemicalfacilities.

Congressional Actions. The 107th Congressenacted the Maritime Transportation Security Act of 2002 (MTSA) ( P.L. 107-295 ). The MTSAassigned the Coast Guard the responsibility of securing U.S. ports. Ports and facilities located withinports must perform vulnerability assessments and develop security plans. Ports are often the locationof chemical facilities, such as petroleum refineries. According to the Coast Guard, 238 chemicalfacilities must comply with MTSA. (18) For more information, see CRS Report RL31733 Port andMaritime Security: Background and Issues for Congress, by John F. Frittelli.

The 107th Congress also enacted the Public Health Security and Bioterrorism Preparednessand Response Act ( P.L. 107-188 ). This legislation amended the Safe Drinking Water Act (SDWA)to require community water systems serving more than 3,300 people to perform site vulnerabilityassessments and develop emergency response plans. Plans for addressing known vulnerabilitieswere not required. The vulnerability assessments must be submitted to the EPA. Community waterfacilities receive some federal funding to aid in assessing and addressing critical vulnerabilities. Drinking water systems storing large quantities of chemicals may be considered chemical facilitiesand, if those facilities serve a sufficient population, would fall under SDWA. (19) The contents of theemergency response plans required under the SDWA are not equivalent to the security plans requiredunder MTSA. For more information on EPA implementation of drinking water security, see CRS Report RL31294 Safeguarding the Nation's Drinking Water: EPA and Congressional Actions , by[author name scrubbed].

Federal regulations governing environmental releases, public health, and worker safety havebeen developed and applied to chemical facilities. Some activities undertaken to meet theseregulatory obligations may have an auxiliary security benefit, either by lowering the consequencesof a chemical release or through reduction of a particular vulnerability. Also, federal securityregulations exist for some specific chemical, or chemical-related, facilities. In general, these securityregulations were developed to protect facilities against criminal activities, such as vandalism or theft,rather than terrorist attack. Examples of such security regulations include the protection of liquifiednatural gas storage facilities (49 CFR 193), hazardous liquids pipeline pumping stations (49 CFR195.436), and storage sites for hazardous materials shippers (49 CFR 172.800).

Federal Agency Action. Under the above statutes,the EPA and DHS engage in increasing chemical facility security. Facility owners and operators canassess site security using vulnerability assessment tools developed by each agency. The EPA, inconjunction with Sandia National Laboratories and the AWWA Research Foundation, developedRisk Assessment Methodology for Water Utilities (RAM-W), a risk assessment methodology forwater systems. (20) TheDHS, through the American Society of Mechanical Engineers (ASME), developed an assessmenttool called Risk Assessment and Management for Critical Asset Protection (RAMCAP), which iscurrently being employed in the chemical industry under a pilot program. (21)

The DHS, as the lead federal agency for the chemicals sector under Homeland SecurityPresidential Directive 7, visits selected chemical facilities. To prioritize outreach to the chemicalssector, DHS has divided, using DHS-determined metrics, the universe of RMP facilities into fourtiers. Only 272 facilities occupy the top two tiers. Representatives from either the U.S. Coast Guardor the Information Awareness and Infrastructure Protection Directorate have visited each of thesetop tier facilities. (22) Inaddition, DHS employees conduct site assessment visits in conjunction with local law enforcement. These "inside-the-fence" vulnerability assessments have been performed at 38 of the highestconsequence facilities. The DHS plans to visit 50 more in FY2006. (23)

The DHS also maintains the Buffer Zone Protection Program (BZPP), which providestargeted funding through states to local jurisdictions in order to enhance security surrounding criticalinfrastructure facilities. (24) This program is not specific to chemical facilities, but insteadis designed to increase the level of general critical infrastructure security. As of April 2005, stateHomeland Security Advisors submitted to DHS 113 buffer zone protection plans developed forchemical facilities. (25) According to the Government Accountability Office, DHS has identified 259 chemicalmanufacturing plants and storage and supply facilities eligible under the 2005 BZPP criteria ofpotentially affecting more than 50,000 people through a chemical release. (26) In 2006, DHS establishedthe Chemical--Buffer Zone Protection Grant Program. This program focuses exclusively onchemical facilities and provides total funding of $25 million to nine states to enhance buffer zoneprotection planning surrounding chemical manufacturing facilities. (27)

The Chemical Sector Coordinating Council (CSCC), formed in May 2004, is a point ofcontact for DHS to communicate across the chemicals sector. The CSCC is comprised of 16chemical associations. (28) The DHS is working with the CSCC on a ChemicalSector-Specific Plan as part of the National Infrastructure Protection Plan. The DHS is also currentlypiloting the Homeland Security Information Network -- Chemical, an information sharingmechanism, through the CSCC. (29) This activity occurs in addition to the previously establishedInformation Sharing and Analysis Center established through the American Chemistry Council. (30)

Policy Issues

Policymakers may decide to develop legislation with new authorities that would requireadditional chemical facility security. Key policy issues that may arise during the consideration ofsuch legislation include the adequate coverage of the chemical facility universe; the federal agencyoverseeing any new requirements; the extent of new security measures required, such as requiringincreases in physical security or reducing chemical hazards through alternative approaches; treatmentof existing federal and state laws; and recognition of preexisting industry security efforts.

Understanding Chemical Facilities

Establishing a definition of the phrase chemical facility is a key component of potentiallegislation. As the DHS Acting Under Secretary for Information Analysis and InfrastructureProtection testified,

... the very first thing we're going to have to do is cometo an adequate, agreed- upon definition of what the chemical sector actually is, because without that,we will be going all over the place. (31)

Some people include only facilities involved in chemical manufacture and distribution. Othersinclude any site containing chemicals. The narrowness or breadth of this definition will likelyinfluence the practicability of security regulations and determine the degree of security riskreduction.

This section discusses three possible mechanisms for selecting chemical facilities for securityregulation, based on a list of chemicals, the potential consequences of a terrorist attack, or anindustrial classification. Considering the breadth of U.S. chemical sites that could be attractivetargets for terrorists, it is likely that a comprehensive definition will require a combination ofapproaches.

Defining by Chemical. Environmental and safetylegislation often list, or direct an agency to list, chemicals for regulation, and then require regulationof those facilities that contain them, usually at levels above certain threshold quantities. Examplesof such legislation include the Emergency Planning and Community Right to Know Act (EPCRA),passed as part of the Superfund Amendments and Reauthorization Act ( P.L. 99-499 ), and the CleanAir Act Amendments of 1990 ( P.L. 101-549 ), which established both the Environmental ProtectionAgency (EPA) risk management program and the Occupational Safety and Health Administration(OSHA) process safety management program.

One challenge in using this approach may be determining which chemicals to include whenconsidering chemical facility security. Existing federal chemical lists are generally developed forother reasons, and therefore may not be appropriate for security purposes. For example, theDepartment of Transportation list for regulation of transport of hazardous materials contains severalthousand chemicals, not all of which are a security risk. (32) The OSHA process safety standard applies to a group of highlyhazardous chemicals selected because of their potential hazard to workers. (33) The EPCRA lists severalhundred chemicals in order to ensure the safety of first responders in the event of a chemicalaccident. (34)

The Clean Air Act, Section 112(r), requires a risk management plan (RMP) for facilitiespossessing more than threshold quantities of any of 140 chemicals. (35) These chemicals areincluded because of their potential for acute, offsite consequences to human health or theenvironment in the event of a sudden, large, accidental release. The risk management programrequires these facilities to estimate the population that might be affected under a worst-case scenariorelease, calculating the population that resides within a circle surrounding the facility, with the radiusof the circle determined by the distance the worst-case scenario release might travel. (36) While these estimates arenot intended to model a potential terrorist release, the potentially affected population in a worst-casescenario is often cited in discussing chemical facility security risks.

Such hazardous chemical lists generally identify chemicals based on an inherent hazard, suchas toxicity or flammability. One potential drawback to defining facilities by referring to these listsis that they exclude potentially hazardous chemicals for reasons other than risk. For example, theRMP list, often referred to in discussions of chemical facility security, does not includeexplosives. (37) It alsoexempts material already regulated under 49 CFR 192, 193, and 195, such as liquified natural gas,which is covered by other safety regulations. (38) The list of RMP facilities was further reduced by statute toexclude facilities where flammables are stored on site as fuel or for retail distribution as fuel. (39) Congress may or may notwant to include such exempted materials when considering chemicals in a terrorism context.

Of course, any of the above lists, or any other chemical list, might be edited to meet thesecurity need. To better focus federal resources, a much shorter list of chemicals might be desirable. Alternatively, an appropriate federal agency might develop a new chemical list specifically forsecurity purposes, avoiding a focus on previous lists. One safety expert testified that

I would not want [the Department of] HomelandSecurity to think that somehow it can pull out of another agency the named list of chemicals and talkto the industry and say these are the only ones we're going to worry about. (40)

Policymakers might require a federal agency, such as EPA or DHS, to develop and maintain sucha list. If Congress wants chemical facility security efforts to address particular chemical threats, itmight list specific chemicals in statute, while allowing the federal agency to modify the list. (41)

Defining by Consequence. Another potentialcriterion for determining which chemical facilities to address is the likelihood and severity of adverseconsequences in the case of a terrorist attack. Such consequences might include the possibility orprobability of injury, loss of life, financial harm, environmental damage, or loss of critical chemicalproduction. Experts disagree on how best to determine the likelihood and severity of theseconsequences, their relative importance, and whether these different consequences lend themselvesto comparison, should be considered independently, or can be appropriately ranked.

Because federal resources are limited, prioritizing chemical facilities by risk may be aneffective approach to maximizing the benefits from security spending. DHS Secretary Chertoff,implying such an approach, stated, "When you start to think about your priorities, you're going tothink about making sure you don't have a catastrophic thing first." (42) A risk-prioritizationapproach may allow the development of thresholds defining risk characteristics for chemicalfacilities, and thereby determine which chemical facilities should receive federal resources or requirefederal attention. The magnitude of the threshold used would likely determine several characteristicsof the chemical facility universe, including the inclusion or exclusion of different types of chemicalfacilities, the regional distribution of facilities, the degree of potential increased security, and theprogram cost.

An additional factor in defining by consequence involves the type of data that might be usedto determine a risk threshold. What metric is most appropriate and how should it be determined? For example, in considering human casualties, should one consider a worst-case scenario or a moreprobable release? The degree of complexity and accuracy required to model these scenarios mightbe an area of contention. For example, DHS uses a different methodology to determine potentiallyaffected people following a terrorism-related chemical release than EPA uses when assessingpotential risks from accidental releases.

The potentially affected residential population in the EPA RMP program's worst-casescenario is often cited in the debate about chemical facility security. These predictions are knownto be very conservative and are intended to be used for planning purposes by emergency responseorganizations and government agencies. Some analysts assert that these RMP figures are a viablestarting point for prioritizing chemical facility risk. (43) Other analysts assert that RMP figures overestimate the actualnumber of casualties. For example, DHS modeling of one specific facility showed that the numberof persons potentially affected was much lower than projected from regulatory calculations. (44)

Still others contend that the RMP figures may underestimate the casualties from a terroristattack, as the scenarios are modeled on a release from a single chemical process. Since manychemical processes may be located in a chemical facility, it is possible that a greater amount ofchemical might be released during an intentional attack than during an accidental release. (45) Determining the extentof likely casualties from a release might require extensive modeling of facility location,meteorological information, surrounding population distribution, and other factors, which may proveto be prohibitively difficult for a large number of chemical facilities.

Defining by Industry Classification. Anotherapproach towards defining chemical facilities might be by industrial classification. Such anapproach appears to align with The National Strategy for Physical Protection of CriticalInfrastructure and Key Assets and Homeland Security Presidential Directive 7 (HSPD-7), wherecritical infrastructure is subdivided into specific infrastructure sectors and federal agencies areassigned lead roles for each sector. (46) Critical infrastructure sectors may be composed of similarindustries or of industries with common elements. For example, HSPD-7 identifies an "energy"sector and a "chemical and hazardous materials" sector. The latter sector is defined to includechemical manufacturers and processors. The range of facilities that policymakers may wish toinclude in chemical facility legislation may not align cleanly, however, with either a particularindustrial classification or with a single critical infrastructure sector. For example, users of largeamounts of chemicals, such as water or wastewater treatment facilities, may fall into a criticalinfrastructure sector other than "chemical and hazardous materials."

The Department of Labor uses the North American Industrial Classification System (NAICS)to classify employment and economic data by industry. (47) NAICS codes are hierarchical; codes containing more digits aresubsets of codes containing fewer digits. For example, NAICS code 3251 (Basic ChemicalManufacturing) is a subset of NAICS code 325 (Chemical Manufacturing). The NAICS codes areoften self-assigned, in that a facility determines which NAICS code appropriately defines its businessactivity. Therefore, an approach relying on these codes might be susceptible to error due to incorrectself-assignment. On the other hand, federal agencies use such industry classification schemes toassess economic activity across industry groups, indicating that this self-classification scheme maybe acceptable.

Defining chemical facilities according to industry classification might lead to the "one sizefits all" approach to chemical facility security criticized by various industry groups. (48) Such an approach mayrequire facilities that are not a security risk to increase their security solely because of their industryclassification, rather than their actual risk. Such security efforts might not reduce the national riskand might be viewed as counterproductive, potentially impairing economic efficiency withoutincreasing security. Moreover, due to fiscal constraints, smaller facilities might be unable to meetrequirements designed for larger facilities, potentially damaging a company's ability to operate. (49) , (50)

Effects of Thresholds on Chemical Facilities

The relative representation of the different chemical-using industries will depend on thechoice of legislative definition. Some security experts argue that any chemical facility that couldendanger the surrounding residential population should be considered under chemical facilitysecurity legislation. (51) Others advocate a tiering system based on a consequence metric.

Depending on the legislative definition, different infrastructure sectors will be included aschemical facilities. The types of infrastructure sectors included as chemical facilities might bereduced by using a consequence threshold, as this would further refine the number of affectedfacilities. This section will use the EPA RMP data as a case study to discuss the types ofinfrastructure sectors found in the RMP program and to illustrate the impacts of applying aconsequence threshold.

Types of Facilities. A potential difficulty offocusing on a particular industry sector, or of using industrial classification to define chemicalfacilities, derives from the diverse impacts that particular industries have on security. That is,depending on the magnitude of the consequence, different industrial classifications account for themajor portion of the chemical facility risk universe. In Figure 1 , CRS grouped NAICS industrycodes into infrastructure sectors used in HSPD-7. (See Appendix A for a description of howinfrastructure sectors were constructed from NAICS codes.) As Figure 1 shows, lowering theconsequence threshold greatly expands the number of facilities and the relative shares of the waterand the food and agriculture sectors.

Figure 1. Infrastructure Sector Representation for RMP Facilities at Two Worst Case Scenario Thresholds

Source: CRS analysis of the EPA RMP*National Database (with off-site consequence analysis(OCA) data), updated May 2005.

Note: It is unlikely that the entire population would be affected by any single chemical release, evenif it is a result of a worst-case accident. In the event of an actual catastrophic chemical release,meteorologic and other effects will determine the direction of the release, and which of the potentialat risk population might be affected. In addition, worst-case scenarios do not take into accountemergency response measures that might be taken by operators of the facilities or others to mitigateharm.

A sector-specific approach will leave some security risks unaddressed. Even at higherthresholds, significant portions of the chemical facility universe may not be addressed bysector-specific legislation. On the other hand, as the threshold for inclusion in a chemical facilitysecurity framework is lowered, additional infrastructure sectors grow in relative representation, asis seen by the food and agriculture sectors in Figure 1 . Because of the increased representation ofthese industry sectors, chemical facility security regulations will likely need to be more flexible toaccount for different operating environments and business needs.

Number of Facilities. As the consequencethreshold is lowered, chemical facility security regulation would apply to more facilities. Thenumber of facilities increases non-linearly as the threshold decreases. Table 1 illustrates this effectby presenting the number of RMP facilities included at selected potential consequence thresholds.

Table 1. Number of RMP Facilities Reporting at SelectedPotential Consequence Thresholds

Source: CRS analysis of the EPA RMP*National Database (with off-site consequence analysis(OCA) data), updated May 2005.

Note: It is unlikely that the entire population would be affected by any single chemical release, evenif it is a result of a worst-case accident. In the event of an actual catastrophic chemical release,meteorologic and other effects will determine the direction of the release, and which of the potentialat risk population might be affected. In addition, worst-case scenarios do not take into accountemergency response measures that might be taken by operators of the facilities or others to mitigateharm.

Chemical facility security legislation that incorporates a low threshold may affect additionalsmaller facilities not generally considered as chemical facilities, such as agricultural retailers or smallwater treatment systems. Whether these industries are the intended targets of any chemical facilitysecurity regulation is a topic facing policymakers.

The large contribution of the water sector to the RMP chemical facility universe also raisesthe question of whether existing security efforts taken under the SDWA are sufficient to secure thissector. For example, from Figure 1 , the water sector (consisting of both drinking water treatmentand wastewater treatment facilities) is 18% of all facilities under the 100,000 affected threshold, butcomprises 34% of facilities under the 10,000 affected threshold. Wastewater treatment facilities,which comprise roughly half of the water sector at both thresholds used in Figure 1 , are notaddressed under the SDWA. Should policymakers accept that drinking water facilities areadequately secured through prior legislation, it still would leave many water sector contributors tothe RMP chemical facility universe.

However, including all chemical facilities equally in a security program may create anunmanageable burden on low-risk chemical facilities. High risk chemical facilities are likely larger,possessing a greater ability to meet security requirements. Smaller chemical facilities required tomatch the security measures put in place by larger chemical facilities may not be able to do sobecause of fiscal limitations.

Lead Federal Agency

Which federal agency should possess chemical facility security oversight responsibilities isa topic of debate. Some analysts assert that the EPA possesses a historic relationship with both thechemical industry and specific chemical facilities. They claim that the EPA is knowledgeable aboutchemical facility operation and security, that the EPA would be well-positioned to understand thepotential impacts of security regulation, and that the EPA would be likely to create effectiveregulation. This coupling of safety and security was supported by the U.S. Coast Guard, whichtestified that security auditing under MTSA often occurred while the U.S. Coast Guard was presentat the chemical facility for safety reasons. (52) Other analysts claim that the EPA is unlikely to be the correctoversight body for chemical facility security. They cite the potentially contentious relationship thatthe EPA, which already oversees safety and facility emissions, might develop with the chemicalindustry. They assert that regulation of security may need to be met through a collaborative processbetween the oversight agency and the facilities, so it should be divorced from environmentalregulation.

The DHS is the other federal agency most often cited as appropriate for overseeing chemicalfacility security. Advocates claim that a good working relationship already exists between DHS andindustry and that DHS's expertise in security is a dominant factor. Opponents of this view argue thatsecurity measures, absent environmental protection and safety considerations, may generate adverseside effects. For example, while burying storage tanks underground might increase the security ofthese tanks, such an approach might pose an environmental risk from potential tank leakage. Consequently, some analysts suggest an approach combining the skills of both DHS and EPA inoverseeing chemical facility security.

Extent of Security Measures

If legislation requires chemical facilities to implement new security measures, the extent ofthese measures may also be an issue of contention. Consensus is lacking regarding whether thereshould be auditing of vulnerability assessments, federal inspection of security measures, and requiredconsideration of alternative approaches, such as inherently safer technologies.

Auditing of Vulnerability Assessments and SecurityPlans. Existing federal laws governing some chemical facilities have taken diverseapproaches to vulnerability assessments for chemical facilities. The Maritime TransportationSecurity Act (MTSA) requires both the development of site vulnerability assessments and theremediation of those vulnerabilities identified. The Safe Drinking Water Act (SDWA), as amended,requires drinking water facilities to develop site vulnerability assessments and emergency responseplans, but not to remediate vulnerabilities. Under both laws, the appropriate federal regulatoryagency receives the site vulnerability assessments. Under the MTSA, the DHS has the authority toinspect port facilities, assess their security plans and actions, and determine whether the facilitiesmeet DHS security standards. The EPA was not granted similar authorities under SDWA.

Policymakers might decide to require that site vulnerability assessments be performed for allchemical facilities and supplied to the federal government or others. Verification and validation ofvoluntary security plans is a topic of continuing concern by advocacy groups, so policymakers mightprovide the federal oversight agency the authority to inspect and assess compliance with vulnerabilityassessments and any remediation requirements. However, in contrast to the limited number ofchemical facilities covered by MTSA, a broad legislative definition of chemical facilities couldinclude thousands of facilities. The logistical burden of inspecting these facilities on a recurringbasis could be quite high for a federal agency. Current agency staffing may be insufficient to meetthis requirement. Consequently, requiring federal auditing and validation of chemical facilitysecurity may be difficult to implement in a timely manner. Auditing responsibilities could bedelegated to state or local officials to reduce the burden placed on federal agencies.

Alternatively, Congress could authorize agencies to license third-party auditors and acceptcompliance reports they might submit on behalf of chemical facilities. DHS Secretary Chertoff hasexpressed support for Congressional consideration of such third-party validation. (53) Fees from such a programcould offset auditing costs. If such auditing were done by third parties or was enforced by a differentmechanism, such as holding facility owners or operators liable for security measures at the chemicalfacilities, costs might be somewhat reduced. Critics of outside auditing question the impartiality andrigor of such reviews, citing breakdowns in analogous financial auditing approaches. (54)

Some experts suggest requiring owner or operator certification of security measurecompliance, with associated criminal liabilities for noncompliance. (55) Such an approach, coupledwith inspections, might provide incentives to businesses to maintain high security standards.

Prescriptive Versus Performance-basedRequirements. The basis for chemical facility security requirements is another areaof contention. Chemical trade associations and others have testified that chemical facility securityrequirements should be risk-based and provide clear guidelines regarding federal expectations. (56) Also, they have requestedfederal assistance and access to federal records, for background checks and other purposes, as partof meeting security standards. (57)

DHS Secretary Chertoff has emphasized the need for risk-based prioritization in homelandsecurity activities. (58) The DHS testified that the federal government, in approaching chemical facility security, shouldadhere to three core principles:

Chemical facilities present different levels of risk, and the most scrutiny shouldbe focused on those that have the greatest consequences.

Chemical facility security should be based on reasonable, clear, and equitableperformance standards, developed by DHS. Chemical facilities should be able to select amongappropriate site specific security measures.

Chemical facility security efforts should recognize voluntary industryefforts. (59)

Some analysts argue for strong performance standards, requiring chemical facilities to be ableto repel armed assault, as required of the nuclear power industry. (60) Others have cited the U.S.Coast Guard's implementation of the MTSA as a good model for performance-based requirements.

Existing security regulation for some chemical storage facilities, such as liquified natural gas,is prescriptive in nature. Federal regulation governs security procedures, protective enclosures,communications, monitoring, lighting, power sources, and warning signs. (61) Some experts assert thatsuch prescriptive regulations lead to outdated security standards should threats or vulnerabilitieschange. Policymakers may consider whether security requirements should be prescriptive orperformance-based, and whether any such requirements should be placed directly in legislation, orwhether the implementing agency should be provided the discretion to determine securityrequirements.

Inherently Safer Technologies. The applicationof inherently safer technology to increase chemical facility security is also a subject of debate. Theconcept of inherently safer technology involves altering a chemical process by substituting lesshazardous materials, minimizing the amount of hazardous material on hand, altering the processconditions, or designing operation so that it is more tolerant of error. (62) Advocates of inherentlysafer technology state that its application would directly reduce security risks, because the hazardposing the security risk would be replaced or reduced. (63) While acknowledging that not all chemical processes haveinherently safer alternatives, advocates cite cases where inherently safer alternatives are known andcould be employed. (64) They claim that federal security legislation should require at least the consideration of thesetechnologies when addressing chemical facility vulnerabilities.

Industry trade associations are generally resistant to legislation mandating the use of, orincorporating a requirement to consider, inherently safer technology. They state that decisionsregarding the use of inherently safer technology are weighed on a process and facility basis and areregularly considered by process engineers when optimizing and assessing process change. (65) Additionally, they cite thepotential to impact process safety negatively should inherently safer technology approaches beincorrectly implemented. For example, if stockpiles of a hazardous chemical are reduced, more,smaller shipments may be required. More connections would be required to transfer the sameamount of material from smaller shipments. This might lead to greater risk for workers making thesetransfers. Lastly, industry trade associations express concern that if inherently safer technologyimplementation decisions are not made by process safety experts, future difficulties and potentialimpracticalities may arise. (66)

Another consideration discussed in the context of inherently safer technologies is thepotential to transfer risk from one chemical facility to another chemical facility. (67) Process changes, such asthe conversion of wastewater treatment from chlorine as a disinfectant to sodium hypochlorite as adisinfectant, may lower the potential consequences at that facility, reducing the risk to thesurrounding area. Those process changes may, however, increase the risk at a different point in thesupply chain. For example, the facility converting chlorine into sodium hypochlorite may increaseits chlorine stocks to address a greater demand for the sodium hypochlorite end product, increasingthe potential consequences surrounding that manufacturing facility. Depending on the relativepopulation at each facility, fewer or more individuals may be put at risk by the facility processchange.

Experts in process engineering have testified that research in inherently safer technology isstill nascent. While some practical examples of inherently safer technology have been developed,they assert that metrics for comparing one technology to another to determine its inherent safety arenot yet defined. (68) Assuch, they challenge whether new inherently safer technology will be developed for chemicalprocesses without an extensive research effort and question the feasibility of mandatingimplementation of inherently safer technology. (69)

Safety regulation requiring the consideration of inherently safer technology has beendeveloped on the state and local level. For example, New Jersey, in implementing the ToxicCatastrophe Prevention Act, requires the consideration of inherently safer technology for all newfacilities and processes covered under the act. (70) Mandatory chemical facility security standards recentlyimplemented in New Jersey now require chemical facilities regulated under the Toxic CatastrophePrevention Act to consider inherently safer technologies for existing processes. (71) In contrast to concernsvoiced by critics of inherently safer technology, the New Jersey Department of EnvironmentalProtection has found that such "evaluation of inherently safer technology is not overly burdensomeon industry." (72) ContraCosta County, California, also requires the consideration of inherently safer technologies. (73) Policymakers, inconsidering inherently safer technologies, may wish to assess whether new processes or facilities arefundamentally different than existing processes or facilities, and might benefit from a securityrequirement to consider inherently safer technologies. (74)

Consequences of Noncompliance. If newchemical facility security requirements are established, penalties for not meeting these standardsmight need to be determined. Civil or criminal penalties, such as fines, might be assessed againstfacility owners or operators, whose security did not meet program standards. If a tiered system ofsecurity requirements were established, penalties might be tiered as well. Some might argue thoughthat the effect of tiering would be to lower penalties below what would be sufficient to ensurecompliance, while others might contend that penalties should be more directly related to the criteriadetermining the tiering.

A different approach to enforcing compliance would be to enable the federal agencyimplementing the chemical facility security program to prevent operation of a facility if it is out ofcompliance with the program. The U.S. Coast Guard is granted this authority under MTSA. Suchlanguage could be developed for any new program. Stakeholder concerns regarding such anauthority would likely revolve around details of its use, such as the ability of a facility to appeal suchauthority. The authority to stop operation of a chemical facility due to insufficient security woulddirectly affect the fiscal viability of a facility, providing a strong incentive to maintain compliancewith security requirements. However, for those facilities with fiscal challenges, blocking theiroperation might significantly threaten the facility's economic stability.

Coordinating Regulatory Initiatives With Existing Efforts

Policymakers may wish to coordinate chemical facility security approaches with existing stateand federal regulation. Developing equivalent criteria, exempting facilities covered under otherregulation, and determining whether federal standards preempt or form the base for state regulationare some of the options available to policymakers.

MTSA and SDWA. The MTSA and SDWA,both of which cover some chemical facilities, mandate different regulatory agencies, securityrequirements, and authorities regarding noncompliance. The DHS, through the U.S. Coast Guard,implements the MTSA, while EPA implements the SDWA. The SDWA requires vulnerabilityassessment, but not remediation, while MTSA requires both vulnerability assessment andremediation. The MTSA grants the Coast Guard the ability to close facilities that lack appropriatesecurity, while the SDWA does not. Legislation affecting all chemical facilities could bridge theseregulations and attempt to reconcile their requirements. Chemical facility legislation might requirethe higher standard to be applied to all chemical facilities, thereby requiring those water facilities thatalso qualify as a chemical facility to increase their site security activities. Alternatively, it mightrequire all chemical facilities meet the SDWA standard, leaving MTSA-regulated facilities with ahigher security requirement. As a third option, new chemical facility security requirements mightexempt facilities regulated under the MTSA or SDWA.

State and Local Regulation. States have passedchemical facility security legislation. Policymakers may wish to decide how existing and proposedfederal regulations might mesh with state requirements. While all states contain chemical facilities,depending on the facilities located in each state, the perception of likelihood and consequence of aterrorist attack may vary significantly. While some analysts assert that the potential consequencesof an attack on a chemical facility are such that it poses a homeland security threat, others may claimthat these facilities and the population surrounding them generally reside within the boundaries ofsingle state and would be best served by state, rather than federal, regulation.

Should Congress determine that chemical facility security is a federal homeland securityconcern, policymakers may need to address whether federal regulation will preempt state regulation,or if it will form the base from which states may impose stricter security requirements. Industryassociations suggest that any new federal legislation should supercede state laws. An apparentconcern is that allowing individual states to add security requirements above a federal minimumwould lead to a patchwork of state regulation and, potentially, increased regulatory compliance costs. On the other hand, some federal regulations, such as environmental regulations on air emissions,allow states to enact additional regulations should the state wish to develop stricter standards.

Voluntary Efforts. Some chemical facilitiesengage in security activities absent regulation. Policymakers may decide whether these actionsshould be rewarded. Potential mechanisms for recognizing these activities include economic offsetsfor security costs, granting exemptions from the regulatory framework for facilities undertakingvoluntary efforts, and recognizing voluntary efforts with full or partial equivalency with regulatoryrequirements. Some analysts assert that voluntary efforts should not be rewarded, since a businessincentive -- reduced liability -- already exists for chemical facilities to improve security. Furthermore, even with this incentive, current voluntary security activities may not rise to anacceptable level.

Potential Approaches to Security Legislation

In light of the various policy issues, four overarching legislative approaches emerge. Theapproaches are maintaining the current approach to chemical facility security; increasing availableresources under existing authorities; enhancing existing programs with new authorities specificallyrelated to chemical facility security; and creating new authorities to address chemical facilitysecurity.

Maintain the Status Quo

Some analysts and industry representatives submit that the current mix of voluntary andmandatory activities provide adequate security enhancements and that market forces are good driversof chemical facility security needs. (75) While acknowledging that mandates are needed, DHS SecretaryChertoff recognized the power of market forces, stating, "... we want to acknowledge and recognizethat ultimately, the marketplace itself creates a very strong incentive through business self-interestin enhancing security." (76) Supporters of the status quo do not advocate for new chemicalfacility security legislation, but instead suggest that current security activities focusing on apublic/private partnership with the DHS, coupled with federal support of local first responders andlaw enforcement, continue to provide chemical facilities with security. They assert that the voluntarychemical facility security measures are likely to be implemented at an appropriate and sustainablelevel based on the risk perceived by the facility owners and operators.

Remaining at the status quo would likely not address criticism of the adequacy of voluntarysecurity actions nor the degree of risk that chemical facilities pose to their surrounding communities. Those facilities identified by the DHS as not participating in voluntary security activities would stillbe potentially vulnerable to attack.

The absence of federal legislation would not preclude state or local legislation. Theperception of chemical facility risk may induce states to regulate such facilities, as has occurred insome states. States might enact laws requiring security measures beyond the voluntary activitiescurrently underway, should they deem such laws in the state interest.

Provide Additional Resources Under Existing Law

Another approach to increase chemical security might be to increase the available resourcesfor federal support of chemical facilities. Currently the federal government provides limitedfinancial support to select chemical facilities through MTSA-related grants, but most DHS fundingefforts focus on providing equipment to the first responders in communities surrounding criticalinfrastructure sites. (77) Policymakers could direct DHS to develop mechanisms to provide support directly to high-riskchemical facilities, or to smaller, less profitable facilities. (78) Alternatively, policymakers may wish to investigate otherfunding options, such as tax incentives or credits, to induce chemical facilities to voluntarily increasesecurity.

Given that federal homeland security resources are limited, determining what facilities shouldbe eligible for such grants, incentives, or credits might prove to be challenging. Equitabledistribution may also become a contentious topic, even if an appropriate risk metric is developed forchemical facilities. (79) Finally, an increase in the availability of federal resources for chemical facilities would not addressthe issue of uneven chemical facility security across industry sectors due to voluntary participation. Some might continue to argue that the chemical facility security level would not be high enough toprotect the surrounding population without a federal mandate.

Some analysts suggest that chemical facilities should bear the costs of chemical facilitysecurity. (80) Sincechemical facilities are generally for-profit companies which choose to manufacture products usinghazardous materials, these analysts argue that the public should not bear the costs for reducing thoserisks. Instead, chemical facilities should recoup the cost of security through business activities, forexample by passing on the costs of security to consumers. However, some chemical facilities, suchas drinking water and wastewater facilities, may not be for-profit companies and may raise differentissues in recouping security costs.

Enhance Existing Law with Additional Authorities

Should policymakers decide that the status quo does not meet national security needs, theycould seek to strengthen current laws so that security needs are met. For example, while somesuggest that the existing Clean Air Act provisions could already allow the EPA to regulate chemicalfacilities for security issues, others suggest that the Clean Air Act may not provide statutory authorityallowing the development of such security regulation. (81) Codifying security language into the Clean Air Act, for example,could provide explicit statutory authority to the EPA to oversee chemical facility security. Suchlanguage might build upon existing safety or environmental programs to increase security.

The EPA and OSHA regulation of chemical facilities for environmental and safety purposescan be viewed in conflicting contexts. The existing regulatory relationship may not be amenable tothe protective, cooperative relationship reportedly required for effective security because of historicdisagreements over environmental impacts or worker safety. However, others identify closeoversight and site visits for multiple purposes as effective in maintaining strong security.

Augmenting existing law with additional authorities would likely not resolve concerns aboutan accurate calculation of the number of people potentially at risk from chemical facilities. It mightalso not address concerns regarding the risks from chemicals not currently regulated under existinglaw. Facilities not currently included under these provisions would not be covered and any rankingor ordering of risk based on the worst-case scenarios might be viewed as unrealistic. Additionally,concerns regarding EPA's or OSHA's experience in homeland security might lead some to questionthe skill with which those agencies might regulate chemical facility security. For example, assigningthe EPA security oversight of chemical facilities would be inconsistent with The National Strategyfor Physical Protection of Critical Infrastructure and Key Assets , which assigned the DHS as leadagency for the chemicals sector. On the other hand, just as some are likely to question EPA andOSHA homeland security expertise, others are likely to question the background or readiness of DHSstaff to make complex chemical risk assessments. Finally, this approach might result in facilitiesreporting to multiple federal agencies, for example those facilities that are regulated under the MTSAmight also report to EPA or OSHA. Duplicative and redundant security reporting requirements maybe inefficient or ineffective.

Create New Security Authorities

Another approach to increasing chemical security would be to create a federal agencystatutory authority to oversee chemical facility security. Legislation with this goal has beenintroduced in the current and previous Congresses. (82) A new security program might be structured like the MTSA orSDWA, or might incorporate aspects of other types of programs, such as EPA or OSHA safetyprograms.

A new security program might address concerns voiced by industry about the potential scopeof chemical facility security. Existing programs and outreach efforts might be coordinated with newprogram requirements by clearly identifying the target chemical facility universe. An assessment ofthe comprehensiveness of the defined facility universe of interest to legislators might determine anyneed to tier prospective security requirements. Such considerations might aid in avoiding overlyburdensome regulation by identifying what facilities most require targeted security efforts.

In establishing a new chemical facility security program, Congress could mandate securitymeasures or leave details to the implementing agency. Mandating security measures would forcethe inclusion, or exclusion, of technologies or methodologies deemed necessary by Congress. Establishing authority within the implementing agency to establish and adjust security requirementsas necessary would allow the agency to address changing threats and vulnerabilities, but might allowcritics to assert that statutory standards are too rigorous or not rigorous enough.

If existing security legislation is used as the design basis for a chemical facility securityprogram, coordinating requirements with those security programs may be easy. On the other hand,alignment of existing and new programs may ease coordination between regulatory requirements. Policymakers may wish to decide whether one program has precedence over the other, if therequirements of both programs are applicable to a facility, or if compliance with existing programsshould exempt a facility from the new program.

Similar questions arise with respect to state and local laws or ordinances, and whether afederal program could preempt them. Efforts to design any new federal chemical facility programcould incorporate current state efforts as a starting criteria, or establish new standards. Creating anew federal program with less stringent requirements than existing state programs, and thenpreempting state programs, might lead to criticism that federal legislation reduced, rather thanenhanced, chemical facility security in those locales. A new program which did not preempt stateregulation, on the other hand, might be construed as allowing a mixture of state regulatory standardsto be promulgated, creating a non-uniform regulatory and economic arena. On the other hand, afederal program might dissuade other states from enacting additional, potentially conflicting laws.

Finally, a new chemical facility security program might incorporate current voluntary effortsas part of, or in lieu of, meeting the federal program requirements. If policymakers accept currentvoluntary efforts in lieu of federal program requirements, creating, for example, an exemption forfacilities already engaged in security efforts, critics may challenge the program as not establishinga stringent enough standard. Alternatively, creating a program with requirements at great variancewith current voluntary security efforts, essentially causing those efforts to not be applicable to thenew regulatory program, might be criticized as penalizing those facilities taking positive stepstowards reducing vulnerability. Developing an assessment or audit methodology for voluntarysecurity efforts might provide a new chemical security program with criteria to compare voluntaryefforts with any new program requirements. Thus, any voluntary security efforts that aligned withthe regulatory intent of policymakers would be valued while those that did not align would not be.

Appendix A

The EPA RMP*INFO database provides information on industrial classification of the reported chemical processes. CRS analyzed the worst-casescenario data reported by each facility to the EPA. CRS identified which reported chemical process at each facility potentially affected the greatest numberof persons in a worst-case release. CRS used the NAICS code reported for this chemical process as the NAICS code for the facility. CRS combinedNAICS codes to provide descriptions of infrastructure sectors. In some cases, CRS collapsed four, five, and six digit NAICS codes for the purposes ofclarity. NAICS codes from 1997 were converted into 2002 NAICS codes when found. The combination of NAICS codes presented here is one of manypossible approaches. The manner by which NAICS codes are sorted into infrastructure sectors affects which facilities would be impacted by policydecisions about and approaches towards particular infrastructure sectors. For a list of NAICS codes used to model infrastructure sectors, see Table 2 .

Table 2. NAICS Codes Used to Model Infrastructure Sectors from EPA RMP Data

Source: CRS analysis of the EPA RMP*National Database (with off-site consequence analysis (OCA) data), updated May 2005.