Critical Infrastructure Protection: Progress and Challenges in DHS's Management of Its Chemical Facility Security Program
Released: 2019-02-27T00:00:00

Letter

DHS Has Made Progress Addressing Past Challenges, But Some Actions are Still Under Way

Our past work has identified progress and challenges in a number of areas related to DHS’s management of the CFATS program, including (1) the process for identifying high-risk chemical facilities; (2) how it assesses risk and prioritizes facilities; (3) reviewing and approving facility site security plans; (4) inspecting facilities and ensuring compliance; and (5) efforts to conduct outreach with stakeholders and first responders.

Identifying High-Risk Chemical Facilities

In May 2014, we found that more than 1,300 facilities had reported having ammonium nitrate to DHS. However, based on our review of state data and records, there were more facilities with ammonium nitrate holdings than those that had reported to DHS under the CFATS program. Thus, we concluded that some facilities weren’t required to report to DHS and some that were required may have failed to do so. We recommended that DHS work with other agencies, including the Environmental Protection Agency (EPA), to develop and implement methods of improving data sharing among agencies and with states as members of a Chemical Facility Safety and Security Working Group. DHS agreed with our recommendation and has since addressed it. Specifically, DHS compared DHS data with data from other federal agencies, such as EPA, as well as member states from the Chemical Facility Safety and Security Working Group to identify potentially noncompliant facilities. As a result of this effort, in July 2015, DHS officials reported that they had identified about 1,000 additional facilities that should have reported information to comply with CFATS and subsequently contacted these facilities to ensure compliance. DHS officials told us that they continue to engage with states to identify potentially non-compliant facilities. For example, as of June 2018, DHS officials stated that they have received 43 lists of potentially noncompliant facilities from 34 state governments, which are in various stages of review by DHS. DHS officials also told us that they hired an individual to serve as the lead staff member responsible for overseeing this effort.

DHS has also taken action to strengthen the accuracy of data it uses to identify high-risk facilities. In July 2015, we found that DHS used self- reported and unverified data to determine the risk categorization for facilities that held toxic chemicals that could threaten surrounding communities if released. At the time, DHS required that facilities self- report the Distance of Concern—an area in which exposure to a toxic chemical cloud could cause serious injury or fatalities from short-term exposure—as part of its Top-Screen. We estimated that more than 2,700 facilities with a toxic release threat had misreported the Distance of Concern and therefore recommended that DHS (1) develop a plan to implement a new Top-Screen to address errors in the Distance of Concern submitted by facilities, and (2) identify potentially miscategorized facilities that could cause the greatest harm and verify that the Distance of Concern of these facilities report is accurate. DHS has fully addressed both of these recommendations. Specifically, in response to the first recommendation, DHS implemented an updated Top-Screen survey in October 2016 and now collects data from facilities and conducts more accurate modeling to determine the actual area of impact (formerly called the Distance of Concern), rather than relying on the facilities’ calculation. In response to the second recommendation, DHS officials reported in November 2016 that they reassessed all facility Top-Screens that reported threshold quantities of chemicals posing a toxic release threat, and identified 158 facilities with the potential to cause the greatest harm. In April 2018, DHS officials reported that all of these facilities have since been reassessed using updated Top-Screen information and, where appropriate, assigned a risk tier.

Assessing Risk and Prioritizing Facilities

DHS has also taken actions to better assess regulated facilities’ risks in order to place the facilities into the appropriate risk tier. In April 2013, we reported that DHS’s risk assessment approach did not consider all of the elements of threat, vulnerability, and consequence associated with a terrorist attack involving certain chemicals. Our work showed that DHS’s CFATS risk assessment methodology was based primarily on consequences from human casualties, but did not consider economic consequences, as called for by the National Infrastructure Protection Plan (NIPP) and the CFATS regulation. We also found that (1) DHS’s approach was not consistent with the NIPP because it treated every facility as equally vulnerable to a terrorist attack regardless of location or on-site security and (2) DHS was not using threat data for 90 percent of the tiered facilities—those tiered for the risk of theft or diversion—and using 5-year-old threat data for the remaining 10 percent of those facilities that were tiered for the risks of toxic chemical release or sabotage. We recommended that DHS enhance its risk assessment approach to incorporate all elements of risk and conduct an independent peer review after doing so. DHS agreed with our recommendations and has implemented actions to address both of them.

Specifically, with regard to our recommendation that DHS enhance its risk assessment approach to incorporate all elements of risk, DHS worked with Sandia National Laboratories to develop a model to estimate the economic consequences of a chemical attack. In addition, DHS worked with Oak Ridge National Laboratory to devise a new tiering methodology, called the Second Generation Risk Engine. In so doing, DHS revised the CFATS threat, vulnerability, and consequence scoring methods to better cover the range of CFATS security issues. Additionally, with regard to our recommendation that DHS conduct a peer review after enhancing its risk assessment approach, DHS conducted peer reviews and technical reviews with government organizations and facility owners and operators, and worked with Sandia National Laboratories to verify and validate the CFATS program’s revised risk assessment methodology.

To further enhance its risk assessment approach, in the fall of 2016, DHS also revised its Chemical Security Assessment Tool (CSAT), which supports DHS efforts to gather information from facilities to assess their risk. According to DHS officials, the new tool—called CSAT 2.0—is intended to eliminate duplication and confusion associated with DHS’s original CSAT. DHS officials told us that they have improved the tool by revising some questions in the original CSAT to make them easier to understand; eliminating some questions; and pre-populating data from one part of the tool to another so that users do not have to retype the same information multiple times. DHS officials also told us that the facilities that have used the CSAT 2.0 have provided favorable feedback that the new tool is more efficient and less burdensome than the original CSAT. Finally, DHS officials told us that, as of June 2018, DHS completed all notifications and processed tiering results for all but 226 facilities. DHS officials did not provide an estimated target completion date for these pending risk assessments, noting that completing the assessments is highly dependent on the facilities providing the necessary Top-Screen information.

Reviewing and Approving Facility Site Security Plans

DHS has also made progress reviewing and approving facility site security plans by reducing the time it takes to review these plans and eliminating the backlog of plans awaiting review. In April 2013, we reported that DHS revised its procedures for reviewing facilities’ security plans to address DHS managers’ concerns that the original process was slow, overly complicated, and caused bottlenecks in approving plans. We estimated that it could take DHS another 7 to 9 years to review the approximately 3,120 plans in its queue at that time. We also estimated that, given the additional time needed to do compliance inspections, the CFATS program would likely be implemented in 8 to 10 years. We did not make any recommendations for DHS to improve its procedures for reviewing facilities’ security plans because DHS officials reported that they were exploring ways to expedite the process, such as reprioritizing resources and streamlining inspection requirements. In July 2015, we reported that DHS had made substantial progress in addressing the backlog—estimating that it could take between 9 and 12 months for DHS to review and approve security plans for the approximately 900 remaining facilities. DHS officials attributed the increased approval rate to efficiencies in DHS’s review process, updated guidance, and a new case management system. Subsequently, DHS reported in its December 2016 semi-annual report to Congress that it had eliminated its approval backlog.

Finally, we found in our 2017 review that DHS took action to implement an Expedited Approval Program (EAP). The CFATS Act of 2014 required that DHS create the EAP as another option that tier 3 and tier 4 chemical facilities may use to develop and submit security plans to DHS. Under the program, these tier 3 and 4 facilities may develop a security plan based on specific standards published by DHS (as opposed to the more flexible performance standards using the standard, non- expedited process). DHS issued guidance intended to help facilities prepare and submit their EAP security plans to DHS, which includes an example that identifies prescriptive security measures that facilities are to have in place. According to committee report language, the EAP was expected to reduce the regulatory burden on smaller chemical companies, which may lack the compliance infrastructure and the resources of large chemical facilities, and help DHS to process security plans more quickly. If a tier 3 or 4 facility chooses to use the expedited option, DHS is to review the plan to determine if it is facially deficient, pursuant to the reporting requirements of the CFATS Act of 2014. If DHS approves the EAP site security plan, it is to subsequently conduct a compliance inspection.

In 2017, we found that DHS had implemented the EAP and had reported to Congress on the program, as required by the CFATS Act of 2014. In addition, as of June 2018, according to DHS officials, only 18 of the 3,152 facilities eligible to use the EAP had opted to use it. DHS officials attributed the low participation to several possible factors including:

DHS had implemented the expedited program after most eligible facilities already submitted standard (non-expedited) security plans to DHS; facilities may consider the expedited program’s security measures to be too strict and prescriptive, not providing facilities the flexibility of the standard process; and the lack of an authorization inspection may discourage some facilities from using the expedited program because this inspection provides useful information about a facility’s security.

We also found in 2017 that recent changes made to the CFATS program could affect the future use of the expedited program. As discussed previously, DHS has revised its methodology for determining the level of each facility’s security risk, which could affect a facility’s eligibility to participate in the EAP.

Inspecting Facilities and Ensuring Compliance

In our July 2015 report, we found that DHS began conducting compliance inspections in September 2013, and by April 2015, had conducted inspections of 83 of the inspected 1,727 facilities that had approved security plans. Our analysis showed that nearly half of the facilities were not fully compliant with their approved site security plans and that DHS had not used its authority to issue penalties because DHS officials found it more productive to work with facilities to bring them into compliance. We also found that DHS did not have documented processes and procedures for managing the compliance of facilities that had not implemented planned measures by the deadlines outlined in their plans. We recommended that DHS document processes and procedures for managing compliance to provide more reasonable assurance that facilities implement planned measures and address security gaps. DHS agreed and has since taken steps toward implementing this recommendation. Specifically, DHS revised CFATS Standard Operating Procedures that, as of February 2019, we are reviewing to determine if they sufficiently document the processes and procedures currently being used to track noncompliant facilities and ensure facilities implement planned measures as outlined in their approved site security plans.

In August 2018, we reported that our analysis of DHS data since our 2015 report showed that DHS has made substantial progress in conducting and completing compliance inspections. Specifically, our analysis showed that DHS increased the number of compliance inspections completed per year since DHS began conducting compliance inspections in 2013 and that, for the 2,466 high-risk facilities with an approved site security plan as of May 2018, DHS had conducted 3,553 compliance inspections. Of these, DHS issued corrective actions to two facilities that were not in compliance with their approved site security plan.

In our August 2018 report, we also found that DHS developed a new methodology and performance measure for the CFATS program in order to evaluate security changes made by high-risk chemical facilities, but that the methodology does not measure the program’s impact on reducing a facility’s vulnerability to an attack. We found that DHS could take steps to evaluate vulnerability reduction resulting from the CFATS compliance inspection process. We recommended that DHS incorporate vulnerability into the new methodology to help measure the reduction in the vulnerability of high-risk facilities to a terrorist attack, and use that data in assessing the CFATS program’s performance in lowering risk and enhancing national security. DHS agreed and is taking steps to implement this recommendation. Specifically, in September 2018, DHS reported making progress towards the implementation of two new performance metrics by the end of the first quarter of fiscal year 2019. DHS officials stated that these metrics should, among other things, evaluate the progress of individual facilities in enhancing their security while part of the CFATS program and be used to demonstrate an increase in the security posture across the population of CFATS facilities.

Conducting Stakeholder and First Responder Outreach

In April 2013, we reported that DHS took various actions to work with facility owners and operators, including increasing the number of visits to facilities to discuss enhancing security plans, but that some trade associations had mixed views on the effectiveness of DHS’s outreach. We found that DHS solicited informal feedback from facility owners and operators in its efforts to communicate and work with them, but did not have an approach for obtaining systematic feedback on its outreach activities. We recommended that DHS take action to solicit and document feedback on facility outreach consistent with DHS efforts to develop a strategic communication plan. DHS agreed and has implemented this recommendation by developing a questionnaire to solicit feedback on outreach with industry stakeholders and began using the questionnaire in October 2016.

In August 2018, we reported that DHS shares some CFATS information with first responders and emergency planners, but these stakeholders may not have all of the information they need to minimize the risk of injury or death when responding to incidents at high-risk facilities. While certain facilities are required under the Emergency Planning and Community Right-to-Know Act of 1986 to report some chemical inventory information, which local officials told us they rely on to prepare for and respond to incidents at chemical facilities, we found over 200 chemicals covered by CFATS that may not be covered by these reporting requirements. We also reported that DHS developed a secure interface called the Infrastructure Protection (IP) Gateway that provides access to CFATS facility-specific information that may be missing from required reporting. However, we found that the IP Gateway is not widely used at the local level and officials from 13 of 15 selected Local Emergency Planning Committees we contacted—consisting of first responders and covering 373 CFATS high-risk facilities—said they did not have access to CFATS data in the IP Gateway. We recommended that DHS should take actions to encourage access to and wider use of the IP Gateway and explore other opportunities to improve information-sharing with first responders and emergency planners. DHS concurred with this recommendation and reported in September 2018 that they are taking actions to implement it. Specifically, DHS has revised three fact sheets and an outreach presentation to include information on the IP Gateway and how to request access to it. In addition, DHS plans to ensure contact is made with first responders representing the top 25 percent of CFATS high-risk chemical facilities by no later than March 2019 so that they are properly prepared to respond to incidents at these facilities.

Chairman Thompson, Ranking Member Rogers, and Members of the Committee, this completes my prepared statement. I would be pleased to respond to any questions that you may have at this time.

GAO Contact and Staff Acknowledgements

If you or your staff members have any questions about this testimony, please contact me at (202) 512-3841 or andersonn@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. Other individuals making key contributions to this work include Ben Atwater, Assistant Director; Hugh Paquette, Analyst-in-Charge; Chuck Bausell, Michele Fejfar, Tracey King, and Tom Lombardi.

This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.