Experts agree that chemical facilities are among the most attractive targets for terrorists intent on causing massive damage. Despite the risk these facilities pose, no one has yet comprehensively assessed security at the nation's chemical facilities. EPA regulates about 15,000 facilities under the 1990 amendments to the Clean Air Act because they produce, use, or store more than certain threshold amounts of specific chemicals that would pose the greatest risk to human health and the environment if they were accidentally released into the air. These facilities must take a number of steps, including preparing a risk management plan (RMP), to prevent and prepare for an accidental release and, therefore, are referred to as RMP facilities. These facilities fall within a variety of industries and produce, use, or store a variety of products, including basic chemicals; specialty chemicals, such as solvents; life science chemicals, such as pharmaceuticals and pesticides; and consumer products, such as cosmetics. Some of these facilities are part of critical infrastructure sectors other than the chemical sector. For example, about 2,000 of these facilities are community water systems that are part of the water infrastructure sector. In addition, other facilities that house hazardous chemicals that are listed under the RMP regulations are not subject to RMP requirements because the quantities stored or used are below threshold amounts. Through the RMP program, EPA has gained extensive expertise with chemical facilities and processes that could be useful in helping DHS assess security issues. Federal requirements currently address security at some U.S. chemical facilities. For example, a small number of chemical facilities must comply with the Maritime Transportation Security Act of 2002 and its implementing regulations, which require maritime facility owners and operators to conduct assessments, develop security plans, and implement security measures. In addition, certain community water systems--while not specifically considered chemical facilities but which use and store large volumes of chemicals--are required by the Public Health Security and Bioterrorism Preparedness and Response Act of 2002 to conduct and submit a vulnerability assessment to EPA and prepare an emergency response plan that incorporates the results of the assessment. According to EPA, 1,928 drinking water facilities that are also subject to EPA's RMP program must comply with this act. Some states and localities have also created security requirements at chemical facilities. In addition, the federal government imposes safety and emergency response requirements on chemical facilities that may incidentally reduce the likelihood and consequences of terrorist attacks. For example, Section 112(r) of the Clean Air Act includes a general duty clause directing owners and operators of facilities to identify hazards, design and maintain a safe facility to prevent releases, and minimize the consequences of any accidental releases that occur. Under Section 112(r), RMP facilities must also implement a program to prevent accidental releases that includes safety precautions and maintenance, and monitoring and training measures, and they must have an emergency response plan. The Department of Labor's Occupational Safety and Health Administration's process safety management standard also requires facilities to conduct analyses of their chemical processes which must address hazards of the process, engineering and administrative controls applicable to the hazards, facilities siting, and evaluation of the possible health and safety effects of failures of controls on employees. DHS is developing a plan for protecting the chemical sector that will establish a framework for reducing the overall vulnerability of the sector in partnership with the industry and state and local authorities. At the time of our review, DHS did not provide a specific date for completion of the Chemical Sector-Specific Plan. DHS completed a draft of the plan in July 2004 and has been working to revise it to accommodate changes to DHS's risk management strategy and comments from stakeholders. DHS officials told us that the final plan--which they now expect to complete and release in the fall of 2006--will reflect the basic principles and content described in the draft plan. On the basis of our review of the draft plan and discussions with DHS officials, the final plan will, among other things, (1) present background information on the sector; (2) describe the process DHS will use to develop an inventory of chemical sector assets; (3) describe DHS's efforts to identify and assess chemical facilities' vulnerabilities and plans to prioritize these efforts on the basis of the vulnerability assessments; (4) outline the protective programs that will be created to prevent, deter, mitigate, and recover from attacks on chemical facilities, and describe how DHS will work with private sector and government entities to implement these programs; (5) explain the performance metrics DHS will use to measure the effectiveness of DHS and industry security efforts; and (6) outline the department's challenges in coordinating the efforts of the chemical sector. DHS has also initiated actions to identify the chemical sector's critical assets, prioritize facilities, develop and implement protective programs, exchange information with the private sector, and coordinate efforts with EPA and other federal agencies. DHS is focusing its efforts for the chemical sector by identifying high-priority facilities. As a starting point, DHS has adapted EPA's RMP database of facilities with more than threshold amounts of certain chemicals to develop an interim inventory of 3,400 chemical facilities that pose the greatest hazard to human life and health in the event of a terrorist attack. These are facilities where a worst- case scenario release potentially could affect over 1,000 people. According to DHS, 272 of these facilities could potentially affect more than 50,000 people. DHS is also developing a new risk assessment methodology to compare and prioritize all critical infrastructure assets according to their level of threat, their vulnerability to attack, and the consequences of an attack on the facility. According to DHS, Risk Analysis Management for Critical Asset Protection (RAMCAP) will provide a common methodology, terminology, and framework for homeland security risk analysis and decision making that is intended to allow consistent risk management across all sectors. The RAMCAP process entails chemical facility owners/operators voluntarily completing a screening tool to identify the consequences of an attack. On the basis of the results of the screening tool, DHS will identify facilities of highest concern and ask them to voluntarily complete a security vulnerability assessment. Finally, DHS has implemented a number of programs to assist the private sector and local communities in reducing vulnerabilities. For example, DHS works with local law enforcement officials and facility owners through the Buffer Zone Protection Program to improve the security of the area surrounding a facility. To assess and identify vulnerabilities at chemical facilities, DHS deploys teams of experts from both government and industry to conduct a site assistance visit. DHS had conducted 38 site assistance visits at chemical facilities as of June 15, 2005, and planned to conduct additional visits in fiscal year 2006 on the basis of need. DHS has also installed cameras at some high-consequence facilities, providing local law enforcement authorities with the ability to conduct remote surveillance and allowing state homeland security offices and DHS to monitor the facilities. In addition, DHS distributes threat information to the industry through various means and coordinates sector activities with the Chemical Sector Coordinating Council, an industry-led working group formed voluntarily by trade associations that acts as a liaison for the chemical sector. DHS also coordinates with EPA and other federal agencies through a government coordinating council. EPA officials believe that the agency could further assist DHS by providing analytical support in identifying high-risk facilities that should be targeted in DHS' chemical sector efforts, among other activities. With few federal security requirements, industry associations have been active in promoting security among member companies. Some industry associations, including the American Chemistry Council (ACC), the Synthetic Organic Chemical Manufacturers Association, and the National Association of Chemical Distributors, require member companies to assess their facilities' vulnerabilities and make security enhancements, requiring as a condition of membership that they conduct security activities and verify that these actions have been taken. ACC, representing 135 chemical manufacturing companies with approximately 2,000 facilities, has led the industry's efforts to improve security at their facilities. ACC requires its members to adhere to a set of security management principles that include performing physical security vulnerability assessments using an approved methodology, developing plans to mitigate vulnerabilities, taking actions to implement the plans, and having an independent party such as insurance representatives or local law enforcement officials verify that the facilities implemented the identified physical security enhancements. These reviewers do not verify that a vulnerability assessment was conducted appropriately or that actions taken by a facility adequately address security risks. However, ACC requires member companies to periodically conduct independent third-party audits that include an assessment of their security programs and processes and their implementation of corrective actions. In addition, ACC members must take steps to secure cyber assets, such as computer systems that control chemical facility operations, and the distribution chain from suppliers to customers, including transportation. Other industry associations have encouraged their members to address security by a variety of means. Most of the 16 associations we spoke to have developed security guidelines and best practices. For example, the International Institute of Ammonia Refrigeration, representing facilities such as food storage warehouses, developed site security guidelines tailored to ammonia refrigeration facilities and provides information about security resources to members. Several industry associations have also developed vulnerability assessment methodologies to assist their member companies in evaluating security needs. For example, the National Petrochemical and Refiners Association, in partnership with the American Petroleum Institute, developed a vulnerability assessment methodology tailored to refiners and petrochemical facilities. Despite industry associations' efforts to encourage or require members to voluntarily address security, the extent of participation in the industry's voluntary initiatives is unclear. Chemical industry officials told us they face a number of challenges in preparing facilities against a terrorist attack. Most of the chemical associations we contacted stated that the cost of security improvements is a challenge for some chemical companies. For example, ACC reports that its members have spent an estimated $2 billion on security improvements since September 11, 2001. Representatives of the American Forest & Paper Association and the National Paint and Coatings Association told us that small companies, in particular, may struggle with the cost of security improvements or the cost of complying with any potential government security programs because they may lack the resources larger companies have to devote to security. Industry stakeholders also cited the need for guidance on what level of security is adequate. While DHS has issued guidance to state Homeland Security Offices and the Chemical Sector Coordinating Council on vulnerabilities and protective measures that are common to most chemical facilities, several stakeholders expressed a desire for guidance on specific security improvements. For example, representatives of the National Petrochemical and Refiners Association stated that one reason the association holds workshops and best practices sessions is to meet the challenge of determining the types of security measures that constitute a reasonable amount of security. In addition, industry officials told us that the lack of threat information makes it difficult for companies to know how to protect facilities. A few industry officials also mentioned limited guidance on conducting vulnerability assessments and difficulty in conducting employee background checks as challenges. One industry association stated that it would like its members to receive guidance from DHS on how to conduct vulnerability assessments. Another association expressed frustration because none of the current vulnerability assessment tools address issues specific to their member facilities, which package and distribute chemicals, and it would like DHS to help develop or approve a methodology for this type of facility. Finally, a number of stakeholders we contacted told us that emergency response preparedness is a challenge for chemical companies. An official with an industry-affiliated research center asserted that emergency responders and communities in the United States are prepared to respond to a toxic release. However, other stakeholders we spoke with stated that many facilities have conducted security vulnerability assessments but may not have done enough emergency response planning and outreach to the responders and communities that would be involved in a release. A 2004 survey by a chemical workers union of workers at 189 RMP facilities found that only 38 percent of respondents indicated that their companies' actions in preparing to respond to a terrorist attack were effective, and 28 percent reported that no employees at their facilities had received training about responding to a terrorist attack since September 11, 2001. While environmental laws require emergency response planning for accidental chemical releases, several stakeholders told us facilities need to consider very different scenarios with consequences on different orders of magnitude when planning the emergency response for a terrorist incident. Existing laws give DHS limited authority to address chemical sector security, but DHS currently lacks specific authority to require all high-risk facilities to assess their vulnerabilities and take corrective actions, where needed. A number of existing laws outline DHS's responsibilities for coordinating with the private sector and obtaining information on and protecting critical infrastructure, but these laws provide DHS with only limited authority to address security concerns at U.S. chemical facilities. For example, under the Homeland Security Act, the Secretary of DHS is responsible for coordinating homeland security issues with the private sector to ensure adequate planning, equipment, training, and exercise activities. Furthermore, the Act gives DHS's Under Secretary for Information Analysis and Infrastructure Protection (IAIP) responsibilities related to protecting critical infrastructure, including accessing, receiving, analyzing, and integrating information from federal, state, and local governments and private sector entities to identify, detect, and assess the nature and scope of terrorist threats to the United States; carrying out comprehensive assessments of the vulnerabilities of the nation's key resources and critical infrastructure; developing a comprehensive national plan for securing the nation's key resources and critical infrastructure; and recommending the necessary measures to protect these key resources and critical infrastructure. DHS does not currently have the authority to require all chemical facilities to conduct vulnerability assessments or to enter chemical facilities without their permission to assess security or to require and enforce security improvements. There is also no legislation requiring chemical facilities to provide information about their security and vulnerabilities. Furthermore, except with respect to certain chemical facilities covered under federal security requirements for other critical infrastructures, existing laws do not give DHS the right to enter a chemical facility to assess its vulnerability to a terrorist attack or the authority to require and enforce the implementation of any needed security improvements at these facilities. The Homeland Security Act, with some limited exceptions, does not provide any new regulatory authority to DHS and only transferred the existing regulatory authority of any agency, program, or function transferred to DHS, thereby limiting actions DHS might otherwise be able to take under the Homeland Security Act. Therefore, DHS has relied solely on the voluntary participation of the private sector to address facility security. As a result, DHS cannot ensure that all high-risk facilities are assessing their vulnerability to terrorist attacks and taking corrective action, where necessary. DHS has concluded that its existing patchwork of authorities does not permit it to regulate the chemical industry effectively, and that the Congress should enact federal requirements for chemical facilities. Echoing public statements by the Secretary of Homeland Security and the Administrator of EPA in 2002 that voluntary efforts alone are not sufficient to assure the public of the industry's preparedness, in June 2005, both DHS and EPA called for legislation to give the federal government greater authority over chemical facility security. Similarly, we concluded in 2003, and continue to believe, that additional federal legislation is needed because of the significant risks posed by thousands of chemical facilities across the country to millions of Americans and because the extent of security preparedness at these facilities is unknown. In testimony before the Congress in June 2005, the Acting Undersecretary for IAIP stated that any proposed regulatory structure (1) must recognize that not all facilities within the chemical sector present the same level of risk, and that the most scrutiny should be focused on those facilities that, if attacked, could endanger the greatest number of lives, have the greatest impact on the economy, or present other significant risks; (2) should be based on reasonable, clear, equitable, and measurable performance standards; and (3) should recognize the progress that responsible companies have made to date. He also stated that the performance standards should be enforceable and based on the types and severity of potential risks posed by terrorists, and that facilities should have the flexibility to select among appropriate site-specific security measures that will effectively address those risks. In addition, he said that DHS would need the ability to audit vulnerability assessment activities and a mechanism to ensure compliance with requirements. While many stakeholders--including representatives from industry, research centers, and government--agreed on the need for additional legislation that would place federal security requirements on chemical facilities, they expressed divergent views on whether such legislation should require the use of inherently safer technologies. Implementing inherently safer technologies could potentially lessen the consequences of an attack by reducing the chemical risks present at facilities. The Department of Justice, in introducing a methodology to assess chemical facilities' vulnerabilities, recognized that reducing the quantity of hazardous material may make facilities less attractive to terrorist attack and reduce the severity of an attack. Furthermore, DHS's July 2004 draft Chemical Sector-Specific Plan states that inherently safer chemistry and engineering practices can prevent or delay a terrorist incident, noting that it is important to make sure that facility owners/operators consider alternate ways to reduce risk, such as using inherently safer design, implementing just-in-time manufacturing, or replacing high-risk chemicals with safer alternatives. However, DHS told us that the use of inherently safer technologies tends to shift risks rather than eliminate risks, often with unintended consequences. Some previous chemical security legislative proposals have included a requirement that facility security plans include safer design and maintenance actions, or that facility security plans include "consideration" of alternative approaches regarding safer design. Representatives from three environmental groups told us that facilities have defined security too narrowly, without focusing on reducing facility risks through safer technologies. Noting that no existing laws require facilities to analyze inherently safer options, these representatives believe legislation should require such an analysis and give DHS or EPA the authority to require the implementation of technologies if high-risk facilities are not doing so. Process safety experts at one research organization recognized that reducing facility hazards and the potential consequences of chemical releases makes facilities less vulnerable to attack. However, these experts also explained that inherently safer technologies can be prohibitively expensive and can shift risks onto other facilities or the transportation sector. For example, reducing the amount of chemicals stored at a facility may increase reliance on rail or truck shipments of chemicals. However, the substitution of chemicals such as liquid bleach for chlorine gas at drinking water facilities reduces overall risks. These experts support legislative provisions requiring analysis or consideration of technology options but do not support giving the federal government the authority to require specific technology changes because of the complexity of these decisions. Representatives of two research centers affiliated with the industry told us that while facilities should look at inherently safer technologies when assessing their vulnerability to terrorist attack, safer technologies are not a substitute for security. Industry associations and company officials were strongly opposed to any requirements to use inherently safer technologies. The majority of the industry officials we contacted opposed an inherently safer technologies requirement, with many stating that inherently safer technologies involve a safety issue that is unrelated to facility security. Industry officials voiced concerns about the federal government's second-guessing complex safety decisions made by facility process safety engineers. Representatives from four associations and two companies told us that, in many cases, it is not feasible to substitute safer chemicals or change to safer processes. Certain hazardous chemicals may be essential to necessary chemical processes, while changing chemical processes may require new chemicals that carry different risks. In July 2005 testimony before the Congress, a Synthetic Organic Chemical Manufacturers Association representative explained that while inherently safer technologies are intended to reduce the overall risks at a facility, they could do so only if a chemical hazard was not displaced to another time or location or did not magnify another hazard. Furthermore, process safety experts and representatives from associations and companies report that some safer alternatives are extremely expensive. For example, reducing facility chemical inventories by moving to on-site manufacturing when chemicals are needed can cost millions of dollars, according to a stakeholder. One company also voiced opposition even to a legislative requirement that facilities "consider" safer options. The official explained that the company opposed such a provision--even if legislation does not explicitly give the government the authority to require implementation of safer technologies--because it might leave companies liable for an accident that might have been prevented by a technology option that was considered but not implemented. Despite voluntary efforts by industry associations and a number of DHS programs to assist companies in protecting their chemical facilities, the extent of security preparedness at U.S. chemical facilities remains largely unknown. DHS does not currently have the authority to require the chemical industry to take actions to improve their security. On this basis, DHS has concluded--as we did in 2003 and again in January 2006--that its existing authorities do not allow it to effectively regulate chemical sector security. Since 2002, both DHS and EPA have called for legislation creating security requirements at chemical facilities, and legislation has been introduced without success in every Congress since September 11, 2001. By granting DHS the authority to require high-risk chemical facilities to take security actions, policy makers can better ensure the preparedness of the chemical sector. Furthermore, implementing inherently safer technologies potentially could lessen the consequences of a terrorist attack by reducing the chemical risks present at facilities, thereby making facilities less attractive targets. However, substituting safer technologies can be prohibitively expensive and can shift risks onto other facilities or the transportation sector. Also, in many cases, it may not be feasible to substitute safer chemicals or change to safer processes. Therefore, given the possible security and safety benefits as well as the potential costs to some companies of substituting safer technologies, a collaborative study employing DHS's security expertise and EPA's chemical expertise could help policy makers determine the appropriate role of safer technologies in facility security efforts. For further information about this statement, please contact John B. Stephenson at (202) 512-3841. Karen Keegan, Omari Norman, Joanna Owusu, Vincent P. Price, and Leigh White made key contributions to this statement. Since 2001, the Congress has considered a number of legislative proposals that would give the federal government a greater role in ensuring the protection of the nation's chemical facilities. These legislative proposals would have granted DHS or EPA, or one of these agencies in consultation with the other, the authority to require chemical facilities to conduct vulnerability assessments and implement security measures to address their vulnerabilities. In the 109th Congress, five bills have been introduced but have not yet been acted upon: H.R. 1562, H.R. 2237, S. 2145, H.R. 4999, and S. 2486. High-priority facilities would be required to submit vulnerability assessments and security plans to DHS; other chemical sources would be required to self-certify completion of assessments and plans and provide DHS copies upon request. High-priority facilities would be required to submit vulnerability assessments and to certify that they have prepared prevention, preparedness, and response plans to EPA. Designated chemical sources would be required to submit vulnerability assessments, security plans, and emergency response plans to DHS. The assessment and security plan would be required to address security performance standards established by DHS for each risk-based tier. Chemical sources would be required to self-certify completion of assessments and plans. DHS, in consultation with EPA, would identify high-priority categories of facilities; DHS would receive and review assessments and plans. EPA, in consultation with DHS and state and local agencies, would identify high-priority categories of facilities; EPA would receive assessments and certifications. DHS would designate facilities as chemical sources and assign each chemical source to a risk-based tier. DHS would receive and review assessments, plans and certifications. EPA would have no role. DHS would, when and where it deems appropriate, conduct or require the conduct of vulnerability assessments and other activities to ensure and evaluate compliance; DHS could disapprove a vulnerability assessment or site security plan; following written notification and consultation with the owner or operator, DHS could issue a compliance order. Not later than 3 years after the deadline for submission of vulnerability assessments and response plans, EPA, in consultation with DHS, would review and certify compliance of each assessment and plan; following consultation with DHS, and 30 days after providing notification to the facility and providing advice and technical assistance to bring the assessment or plan into compliance and address threats, EPA could issue a compliance order. DHS would review and approve or disapprove all vulnerability assessments, security plans, and emergency response plans for facilities in higher risk tiers within one year, and within five years for all other facilities. DHS would be required to disapprove of any vulnerability assessment, site security plan, or emergency response plan not in compliance with the vulnerability assessment, site security plan, and emergency response plan requirements. For higher risk facilities, if DHS disapproves the assessment or plans, the Secretary could issue an order to a chemical source to cease operation. For other facilities, the Secretary could issue an order to a chemical source to cease operation, but only after a process of written notification, consultation and time for compliance. Would provide for court awarded civil penalties up to $50,000 per day for failure to comply with an order, site security plan, or other recognized procedures, protocols, or standards, and administrative penalties up to $250,000 for failure to comply with an order. Would provide for court awarded civil penalties up to $25,000 per day, criminal penalties, and administrative penalties (if the total civil penalties do not exceed $125,000) for failure to comply with an order. Would provide for court awarded civil penalties up to $50,000 per day, and administrative penalties of not more than $25,000 per day (not to exceed $1 million per year) for failure to comply with a DHS order or directive issued under the act. Also calls for criminal penalties of up to $50,000 in fines per day, imprisonment for not more than two years, or both for knowingly violating an order or failing to comply with a site security plan. Response plans would be required to include a description of safer design and maintenance options considered and reasons those options were not implemented; EPA would be required to establish a clearinghouse for information on inherently safer technologies and would be authorized to provide grants to assist chemical facilities demonstrating financial hardship in implementing inherently safer technologies. None. Would exempt information obtained from disclosure under the Freedom of Information Act (FOIA) or otherwise, or from disclosure under state or local laws; information would also not be subject to discovery or admitted into evidence in any federal or state civil judicial or administrative procedure other than in civil compliance action brought by DHS. Calls for DHS, in consultation with others, to establish confidentiality protocols. Would exempt information obtained from disclosure under FOIA; calls for EPA, in consultation with DHS, to establish information protection protocols. Would exempt information obtained from disclosure under FOIA, or from disclosure under state or local laws. Certifications submitted by the chemical sources, orders for failure to comply, and certificates of compliance and other orders would generally be made available to the public. Calls for DHS, in consultation with the Director of the Office of Management and Budget and appropriate federal law enforcement officials, to create confidentiality protocols for the maintenance and use of records; would establish penalties for the unlawful disclosure of protected information. Upon petition, DHS would be required to endorse other industry, state, or federal protocols or standards that the Secretary of DHS determines to be substantially equivalent. None. Would allow the Secretary to determine that vulnerability assessments, security plans, and emergency response plans prepared under alternative security programs meet the act's requirements and to permit submissions or modifications to the assessments or plans. Would grant DHS right of entry; would exempt facilities that are subject to MTSA (port facilities) or the Bioterrorism Act (community water systems). Except with respect to protection of information, would not affect requirements imposed under state law. Would grant EPA right of entry; would authorize EPA to provide grants for training of first responders and employees at chemical facilities; would not affect requirements imposed under state law. Would grant DHS right of entry; would exempt facilities that are subject to MTSA from certain area security requirements but these facilities would otherwise comply with the act's requirements. Would preserve the right of States to adopt chemical security requirements that are more stringent than the Federal standard, as long as the State standard does not conflict with the Federal standard. S. 2486, introduced on March 30, 2006, would impose a general duty on chemical facility owners and operators, in the same manner as the duty under the Clean Air Act's Section 112(r), to identify hazards that may result from a criminal release, ensure the design, operation, and maintenance of safe facilities by taking such actions as are necessary to prevent criminal releases, and eliminate or significantly reduce the consequences of any criminal release that does occur. S. 2486 also directs DHS to work with EPA, as well as state and local agencies, to identify not fewer than 3,000 high priority chemical facilities. These facilities would be required to take adequate actions (including the design, operation, and maintenance of safe facilities), to detect, prevent, or eliminate or significantly reduce the consequences of criminal releases and to submit a report to DHS that includes a vulnerability assessment; a hazards assessment; a prevention, preparedness, and response plan; statements as to how the response plan meets regulatory requirements and general duty requirements; and a discussion of the consideration of the elements of design, operation, and maintenance of safe facilities. "Design, operation, and maintenance of safe facilities" is defined as practices of preventing or reducing the possibility of a release through use of inherently safer technologies, among other things. DHS would certify compliance and DHS and EPA would establish a program to conduct inspections of facilities. The bill also provides for civil penalties, administrative penalties, and criminal penalties (including imprisonment for up to 2 years for first violations and up to 4 years for subsequent violations), for owners or operators of high priority facilities who fail to comply with an order. Also in the 109th Congress, the conference committee for H.R. 2360, making appropriations for DHS for fiscal year 2006, directed DHS to submit a report to the Senate and House Committees on Appropriations by February 10, 2006, describing (1) the resources needed to implement mandatory security requirements for the chemical sector and to create a system for auditing and ensuring compliance with the security standards and (2) the security requirements and any reasons why the requirements should differ from those already in place for chemical facilities that operate in a port zone; complete vulnerability assessments of the highest risk U.S. chemical facilities by December 2006, giving preference to facilities that, if attacked, pose the greatest threat to human life and the economy; and complete a national security strategy for the chemical sector by February 10, 2006. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary:
Terrorist attacks on U.S. chemical facilities could damage public health and the economy. The Department of Homeland Security (DHS) coordinates federal efforts to protect these facilities from attacks. GAO was asked to provide a statement for the record based on its report Homeland Security: DHS Is Taking Steps to Enhance Security at Chemical Facilities, but Additional Authority Is Needed ( GAO-06-150 , January 27, 2006), GAO reviewed (1) DHS's actions to develop a strategy to protect chemical plants, assist with the industry's security efforts, and coordinate with other federal agencies, (2) industry security initiatives, (3) DHS's authorities and the need for additional security legislation, and (4) stakeholders' views on any requirements to use safer technologies. DHS is developing a Chemical Sector-Specific Plan, which is intended to, among other things, describe DHS's ongoing efforts and future plans to coordinate with federal, state, and local agencies and the private sector; identify chemical facilities to include in the sector, assess their vulnerabilities, and prioritize them; and develop programs to prevent, deter, mitigate, and recover from attacks on chemical facilities. DHS officials told GAO that they now expect to complete and release the plan in the fall of 2006. In addition, DHS has taken a number of actions to protect the chemical sector from terrorist attacks. DHS identified 3,400 facilities that, if attacked, could pose the greatest hazard to human life and health and has initiated programs to assist the industry and local communities in protecting chemical plants. DHS also coordinates with the Chemical Sector Coordinating Council, an industry-led group that acts as a liaison for the chemical sector, and with EPA and other federal agencies. The chemical industry is voluntarily addressing plant security, but faces challenges. Some industry associations require member companies to assess plants' vulnerabilities, develop and implement mitigation plans, and have a third party verify that security measures were implemented. Other associations have developed guidelines and other tools to encourage their members to address security. Industry officials said that high costs and limited guidance on how much security is adequate create challenges in preparing facilities against terrorism. Because existing laws provide DHS with only limited authority to address security at chemical facilities, it has relied primarily on the industry's voluntary security efforts. However, the extent to which companies are addressing security is unclear. DHS does not have the authority to require chemical facilities to assess their vulnerabilities and implement security measures. Therefore, DHS cannot ensure that facilities are taking these actions. DHS has stated that its existing authorities do not permit it to effectively regulate the chemical industry, and that the Congress should enact federal requirements for chemical facilities. Many stakeholders agreed--as GAO concluded in 2003 and again in January 2006--that additional legislation placing federal security requirements on chemical facilities is needed. Stakeholders had mixed views on whether any chemical security legislation should require plants to substitute safer chemicals and processes, which could lessen the potential consequences of an attack, but could be costly or infeasible for some plants. DHS has stated that safer practices may make facilities less attractive to terrorist attack, but may shift risks rather than eliminate them. Environmental groups told GAO that they favored including or considering inherently safer technologies in any federal requirements, but most industry officials GAO contacted opposed a requirement to use safer technologies because they may shift risks or be prohibitively expensive.