Plum Island is a federally owned 840-acre island off the northeastern tip of Long Island, New York. It is about 1.5 miles from Orient Point, New York (see fig. 1), and about 12 miles from New London, Connecticut. Access to Plum Island is by a ferry service operated by a contractor that transports employees from Orient Point and Old Saybrook, Connecticut. The U.S. Army used Plum Island during World War II as a coastal defense artillery installation until it was declared surplus property in 1948. In 1952, the U.S. Army Chemical Corps constructed a biological research laboratory, but it was never used. Then, in response to a foot-and-mouth disease outbreak in Canada, the Congress transferred all of Plum Island to USDA in 1954 for the purpose of researching and diagnosing animal diseases from other countries, including foot-and-mouth disease, which has not been seen in the United States since 1929. Foot-and-mouth disease is the most feared foreign animal disease because it is highly contagious and can have serious effects on the economy. Slaughtering susceptible animals and quarantining both animals and humans in affected areas helps limit the spread of the disease, but it can, nevertheless, have devastating economic consequences, as demonstrated during the 2001 outbreak in the United Kingdom. By the time the disease was eradicated, about 8 months later, the United Kingdom had slaughtered over 4 million animals and sustained losses of over $5 billion in the food and agricultural industries, as well as comparable losses in tourism. Many other types of animal diseases are also studied at the Plum Island Animal Disease Center, such as classical swine fever; rinderpest; and a variety of pox viruses, including goat, camel, and deer pox. Some of the diseases are caused by pathogens that are zoonotic—that is, they can infect, and possibly cause death, in both animals and humans. Zoonotic pathogens maintained at Plum Island Animal Disease Center include West Nile virus, Venezuelan equine encephalitis, Rift Valley fever, and vesicular stomatitis. Because of the importance of the livestock industry to the U.S. agricultural sector and economy, protecting livestock from these diseases is an important responsibility. To prevent pathogens from escaping the Plum Island Animal Disease Center and infecting livestock, wildlife, or humans, all research is conducted within a specially designed and sealed biocontainment area within the research facility that adheres to specific safety measures.For example, the biocontainment area has air seals on its doors and operates with negative air pressure so that air passes through a special filter system before leaving the facility. In addition, employees and visitors must change into protective clothing before entering the biocontainment area and shower when going between rooms containing different animal diseases and before leaving the biocontainment area. USDA’s procedures require all people and material leaving the biocontainment area to be decontaminated. The Plum Island Animal Disease Center’s biocontainment area totals approximately 190,000 square feet, and it is unusual because it houses a laboratory facility with 40 rooms for large animals. The three-level laboratory also contains the machinery, such as the air filtration system, necessary for the biocontainment area to function, and the pathogen repository. Individuals entering the biocontainment area have access to all three floors. In contrast, biocontainment areas of other laboratories usually consist of a series of smaller rooms, housing smaller laboratory animals, making it easier to control access to the pathogens. As a result of the September 11, 2001, terrorist attacks, Plum Island Animal Disease Center is now required to abide by new laws and regulations that were generated to help reduce the possibility of bioterrorism. These laws and regulations limit access to pathogens to only approved individuals— those whom USDA has identified as having a legitimate need to handle agents or toxins and whose names and identifying information have been submitted to and approved by the U.S. Attorney General. Specifically, the USA Patriot Act of 2001 prohibits restricted people—such as criminals or those individuals from countries that the Department of State has declared to be state sponsors of terrorism—from shipping, receiving, transporting, or possessing certain dangerous pathogens. In addition, the Agricultural Bioterrorism Protection Act of 2002 requires that USDA develop an inventory of potentially dangerous pathogens. Furthermore, individuals who possess or use pathogens must have background checks and must be registered with the U.S. Attorney General. Implementing this law are regulations that became effective on February 11, 2003, which state that laboratories must be in compliance with the regulations by November 12, 2003. USDA also requires employees to have favorably adjudicated background investigations before working unescorted in the biocontainment area. When USDA contracted with Sandia in October 2001, Sandia evaluated the effectiveness of security at the Plum Island Animal Disease Center and four other USDA laboratories. Using a risk management approach, USDA first identified generic lists of assets, risks, and threats for all five laboratories. Sandia then used USDA’s generic threat definitions to assess the security and vulnerabilities at each laboratory. Sandia officials found that Plum Island’s existing security system was inadequate for protecting against the generic threats that USDA had selected and that it required significant improvement. Sandia officials also found that the biocontainment building was not designed to be a highly secure facility. USDA and Sandia agreed, however, that modifying the facility to withstand an assault would be cost- prohibitive and that, because pathogens occur naturally and are available at other laboratories throughout the world, the risk that a terrorist would try to steal them from Plum Island was not perceived as significant (and their perception has not changed). Consequently, Sandia recommended a limited physical security system designed to deter and detect a security breach and, with assistance from local law enforcement, respond to incidents exceeding the capability of the guard force on the island. DHS assumed formal administration of Plum Island from USDA on June 1, 2003, as provided by the Homeland Security Act of 2002. During a transition period that will last until October 1, 2003, DHS will review USDA’s policies and procedures and determine how best to administer the functions of Plum Island. Until the transition is complete, DHS will administer the facility under the same policies and regulations established by USDA. Ultimately, the two agencies will work together to address national biodefense issues and carry out the mission of the Plum Island Animal Disease Center. While DHS is now formally responsible for security, scientists and support staff of two USDA agencies, the Agricultural Research Service (ARS) and the Animal and Plant Health Inspection Service (APHIS), will continue to implement the Plum Island Animal Disease Center’s research and diagnostic mission. ARS scientists at Plum Island are responsible for research on foreign livestock diseases, while APHIS scientists are responsible for diagnosing livestock diseases. APHIS conducts diagnostic training sessions several times a year to give veterinary health professionals the opportunity to study the clinical signs of animal diseases found in other countries, such as foot-and-mouth disease. According to USDA, scientists from other countries are an integral part of the Plum Island Animal Disease Center’s workforce because they are well qualified and well situated to study the diseases researched there, many of which are endemic to their own countries. These scientists are sponsored by USDA and obtain visas that permit them to work for the department. DHS currently uses USDA’s independent contractor to carry out operations and maintenance functions for Plum Island. The services under the contract include, among other activities, operating the ferries, providing security and emergency fire and medical services, providing buildings and grounds services, meeting utility requirements, and performing custodial functions. On August 13, 2002, 71 of these employees went on strike. The contractor at that time, LB&B Associates, was responsible for handling the strike. On January 6, 2003, LB&B Associates’ contract expired. USDA had initially awarded that contract under a small business program when LB&B Associates still qualified as one. Since that initial award, LB&B Associates had grown so that it no longer was eligible to compete for contracts set aside for small businesses. As a result, USDA awarded the new contract to North Fork Services, a joint venture between LB&B Associates and Olgoonik Logistics LLC, a small minority company of Anchorage, Alaska. Under this arrangement, the more experienced LB&B Associates serves as a mentor to North Fork Services, and most of the employees who worked for LB&B Associates continue to work for North Fork Services. DHS officials told us that they would not renew the contract with North Fork Services. DHS stated that the current terms and scope of the contract are insufficient to operate the facility in accordance with its view of the standards and mission of the Plum Island Animal Disease Center. Before the September 2001 terrorist attacks, the Plum Island Animal Disease Center, like many other federal laboratories, was less conscious of security and focused primarily on the safety of its programs and operations. Since then, USDA intensified its focus on security and has taken strides in developing and installing a security system. However, Plum Island remains vulnerable to security breaches because its security arrangements are incomplete and limited. Security at Plum Island has improved since the fall of 2001. USDA hired a physical security specialist to oversee its efforts to improve security, including the implementation of Sandia’s recommendations, and to provide direction for the security measures being taken for Plum Island. As of July 2003, completed security upgrades include the following: taking measures to prevent unauthorized access to Plum Island by allowing only sponsored visitors on the ferry and island; identifying those sponsored individuals, and allocating passes, when they board the ferry; and staffing Orient Point, New York, with a security guard as well as installing an access gate that can be opened only with an identification card assigned to Plum Island federal personnel; hiring armed guards to patrol the island and observe personnel and visitors entering and leaving the facility. When the nation is on high terrorist alert (code orange) armed guards are added to monitor access to the biocontainment area and to better secure the island’s perimeter. This also allows armed guards to remain in the building while the other armed guards go to the harbor to inspect vehicles unloaded from the ferry and ensure that individuals departing the ferry onto Plum Island have permission to be there; conducting a background check for government staff and contractors working on the island and performing more rigorous checks for individuals with access to the pathogens; installing some video cameras to (1) increase the probability of timely detection of an intruder and (2) monitor the activities of those inside the biocontainment area when they remove pathogens from the storage area—or the repository; installing intrusion detection alarms in the administrative building and the biocontainment area; limiting access to pathogens by installing certain access control devices; and improving pathogen control and accountability by completing and maintaining an inventory of pathogens at the facility, submitting names of those with access to pathogens to the U.S. Attorney General, and creating security and incident response plans, as required by law. Although security at the Plum Island Animal Disease Center has improved over the past few years, fundamental concerns remain. Plum Island’s physical security system is not yet fully operational. For example, the facility does not yet have in place all the equipment necessary to detect intruders in various places. DHS officials agree that these physical security measures are important and anticipate they will be in place by December 2003. In addition, our Office of Special Investigations identified physical security limitations. For example, we found that lighting is inadequate to support the cameras outside of the research complex and vehicles are not properly screened. (See app. II for other limitations identified by our Office of Special Investigations and observations on how they could be addressed.) Moreover, the physical security measures that USDA chose to implement on Plum Island are largely limited to the biocontainment area, where pathogens are located. Consequently, other important assets remain vulnerable. For example, the continued operation of the Plum Island Animal Disease Center is dependent on its infrastructure, which has limited protection. Protecting the infrastructure is particularly important because the Plum Island Animal Disease Center is the only facility in the United States capable of responding to an outbreak and researching foot-and- mouth disease. Therefore, if the infrastructure was damaged, no other facility could step in and continue this foot-and-mouth disease work. Furthermore, Plum Island is the only facility in North America that has a foot-and-mouth disease vaccine bank. This bank represents years of cooperative research performed by Canada, Mexico, and the United States, yet the room containing it has a window opening covered with only plywood. USDA officials said they intend to improve the physical security of the vaccine bank but have not yet decided on the approach to take. In addition, DHS officials agree that the Plum Island Animal Disease Center is vital to combating bioterrorism, and they are evaluating the physical security on Plum Island. Access to pathogens at the Plum Island Animal Disease Center is not adequately controlled. For example, as of July 2003, eight scientists from other countries were working in the biocontainment area without completed background investigations. According to FBI officials, allowing anyone who does not have a completed background investigation access to the biocontainment area—in particular, a scientist from another country—represents a significant security risk. USDA officials told us these scientists were allowed into the biocontainment area to enable research to continue. Furthermore, they stated that background investigations had been initiated for these individuals, and it was assumed that these scientists were being escorted, which USDA policy permits for those with pending background investigations. However, Plum Island officials told us that due to resource constraints, it has not been possible to continually escort and monitor scientists while they are in the biocontainment area. When we brought this concern to the attention of DHS officials, they told us they are developing a more restrictive policy for allowing scientists from other countries to have access to pathogens. In addition, USDA policy does not require background checks on students who attend the foot-and-mouth disease classes that are regularly held in the biocontainment area. In 2002, USDA held six classes with an average of 32 students per class and anticipates continuing these classes in the future. According to USDA’s policy, individuals may enter the biocontainment area without background checks if an approved individual escorts them.We believe this policy warrants reconsideration for several reasons. Allowing students who do not have background checks into biocontainment for purposes of attending foot-and-mouth disease classes, with or without an approved escort, may not be consistent with the regulations implementing the Agricultural Bioterrorism Preparedness Act. These same regulations do not provide an exception for unapproved students or other visitors who may be handling or have access to pathogens. USDA officials told us that maintaining constant visual contact with even one escorted individual is very difficult because of the size and floor plan of the biocontainment area. USDA officials told us that they believe escorting students is sufficient to meet the intent of the regulations. However, DHS officials said that all students should have completed background checks before entering the biocontainment area and told us they will develop a policy that will ensure that this occurs once the transition period is complete. Although USDA’s regulations specifically allow unapproved individuals into the biocontainment area with an approved escort, we found unescorted maintenance workers in the biocontainment area. The regulations provide for unapproved individuals to conduct routine cleaning, maintenance, repair, and other nonlaboratory functions in the biocontainment area if they are escorted and continually monitored by an approved individual.However, early in our investigation we found that as many as five such individuals were working in the biocontainment area without escorts. When we brought this to the attention of USDA officials, they provided an escort for these individuals. DHS officials added that the operating contractor would soon provide security escorts. Controlling access to pathogens is important because no security device can currently ensure that an insider, such as a scientist, will not steal pathogens from the Plum Island Animal Disease Center or other laboratories. According to the director of the Plum Island Animal Disease Center—while under USDA’s administration—and officials from Sandia, the National Institutes of Health, and the U.S. Army Medical Research Institute of Infectious Diseases, pathogens are more difficult to secure than other materials that could be used as weapons, such as nuclear material. This is because there is no existing mechanism capable of detecting the theft of a microgram of pathogenic material and a tiny quantity can be multiplied. Thus, a scientist could covertly generate or divert a pathogen during the normal course of work, remove it from the laboratory undetected, and potentially develop it into a weapon for spreading disease. This inherent problem leaves all facilities with pathogens vulnerable to serious security breaches. Also, the existence of the foot-and-mouth disease pathogen at the Plum Island Animal Disease Center is a particular concern because an undetected theft, followed by the spread of the disease, would have serious economic consequences for the nation. In addition, the presence of zoonotic diseases at the Plum Island Animal Disease Center is worrisome because of the potential for adverse health affects on humans, and two such pathogens are of particular concern. First, U.S. government research has shown that Venezuelan equine encephalitis virus can be developed into a human biowarfare agent. Second, USDA believes that because of the genetic similarities of two pox strains, it may be possible to manipulate camel pox into an agent as threatening as smallpox. Although USDA created an inventory list of the pathogens at the Plum Island Animal Disease Center, as required by law, such a list cannot provide an accurate count of pathogens because quantities of pathogens change as they replicate. Thus far, Plum Island officials have secured pathogens by restricting access to the island itself and to the biocontainment area where the pathogens are located and by locking the freezers containing the pathogens. But DHS officials have not yet had the opportunity to fully consider actions other laboratories are taking to mitigate the likelihood that pathogens could be stolen. Officials at the U.S. Army Medical Research Institute of Infectious Diseases at Fort Detrick, Maryland, told us they are taking several steps, in addition to physical security measures and inventory control, to better safeguard pathogens against theft. For example, they plan to use trained personnel as roving monitors to ensure that unauthorized laboratory work is not being performed, and they will randomly inspect all personnel exiting laboratories. Moreover, they are interviewing scientists periodically and requiring that background checks be updated every 5 years in order to evaluate the continued suitability and reliability of those employees working with pathogens. Although USDA told us background checks were updated every 5 years, according to Plum Island records as of July 2003, 12 current Plum Island employees, some of whom have access to pathogens, had not had their background checks updated in more than 10 years. According to Sandia, other potentially helpful safeguards include creating, implementing, and enforcing strict policies, including those that prohibit researchers from continuing work in the biocontainment area if they do not follow security procedures. DHS officials stated that they have started to work with other laboratories and that measures such as these, while not necessarily a panacea, could help improve the security of pathogens at Plum Island. Plum Island’s incident response capability is limited in four ways. First, the security guards on each shift carry firearms, although Plum Island does not have statutory authority for an armed guard force. USDA operated the guard force on Plum Island without authority for the guards to carry firearms or make arrests. Furthermore, Plum Island officials have not approved a policy that addresses the use of weapons, and, as a result, the guards do not know specifically how they are expected to deal with intruders on the island and when or if they should use their weapons. When we informed DHS officials of these problems, they agreed to resolve them as soon as possible and raised the possibility that the Federal Protective Service could be assigned to guard Plum Island. The Federal Protective Service, now under DHS, has the authority to carry weapons and make arrests.Since DHS has taken responsibility for the island, the Federal Protective Service has visited Plum Island to assess its security requirements. Second, according to the observations of our Office of Special Investigations, Plum Island has too few guards to ensure safety and effectiveness.DHS officials agree with this observation and said that they have requested funds to hire additional guards. Third, arrangements for local law enforcement support are also limited. According to Sandia’s recommended security plan, in the event an incident exceeds the response capability of the Plum Island guards, they would first contact Southold town police, the closest and primary responding law enforcement agency.If still more resources were needed, Southold town police would contact Suffolk County police, the secondary responder. Because of liability issues, however, arrangements with local law enforcement have not been finalized even though there have been continuing discussions with local law enforcement. The result is that Plum Island officials cannot predict the extent to which the Southold town police will provide backup during an incident. On the other hand, officials of Suffolk County, which includes both Plum Island and Southold, told us that although it takes longer for them to respond than Southold police, they could respond with an adequate number of officers, if necessary. In addition, they have requested a map of the island and a tour of the biocontainment area to become more knowledgeable about the facility and its surrounding terrain. Suffolk County officials pointed out, however, that, for geographical reasons, Southold remains the primary responder. In this vein, Plum Island officials have never defined an adequate response time, nor have they conducted exercises with local law enforcement officials to determine how effectively Plum Island and local officials can address an incident on the island. DHS officials agree that the arrangements for local law enforcement support are limited, and they are trying to overcome this problem as quickly as possible by first resolving the issue surrounding the authority to make arrests and carry weapons. In addition, these officials concur that it is important to develop a better understanding of the response times and capabilities of local law enforcement assistance and to conduct exercises to test the adequacy of arrangements once they are completed. Fourth, according to Sandia officials, the incident response plan for Plum Island is not sufficiently comprehensive. Plum Island’s incident response plan contains certain elements required under law, such as how to respond to an inventory violation or a bomb threat. However, because USDA selected a risk management approach to security, Plum Island officials need an incident response plan that clearly lays out the actions to be taken if events occur that exceed the capability of the facility’s security system. For example, Plum Island officials do not have a road map for actions to be taken in the event of a terrorist attack—who gets notified, in what order, and the responsibilities of staff for responding. This is a critical shortcoming because, according to DHS, the nation faces a significant risk of a terrorist attack. Sandia officials also said that the incident response plan for Plum Island requires significant additional development to properly prepare for the complete range of threats. Moreover, the incident response plan does not identify the security steps that should be taken in the event of an outbreak of foot-and-mouth disease or take into consideration any increased risks to the facility, which could severely impede the nation’s capability to contain an outbreak. Finally, according to the FBI and local law enforcement officials, the island’s incident response plan may need to be coordinated with the incident response plans of such nearby facilities as the Millstone nuclear power plant, the Brookhaven National Laboratory, and the laboratories at the State University of New York at Stony Brook because a terrorist attack on any of these facilities could also involve Plum Island. This type of coordination has not yet taken place. DHS officials agree that the incident response plan needs to be more comprehensive and coordinated with national and local law enforcement agencies. Plum Island’s Security Plan Does The risk that an adversary might try to steal pathogens is, in our opinion, Not Address All Risks and Threats higher than USDA believed it to be in 2001, when it defined the same risks for all of its laboratories, including Plum Island. USDA considered the risk that an adversary would try to steal pathogens from any of its laboratories to be relatively low compared to materials found at other laboratories, such as nuclear material or pathogens of a higher consequence to the human population. Since its evaluation in 2001, however, the level of risk at Plum Island has increased because of the strike that occurred in August 2002 and the hostility surrounding it. For example, one striker has been convicted of tampering with the island’s water distribution and treatment system as he walked off the job the day the strike began. USDA officials suspect that this individual did not act alone. In addition to this incident, USDA asked the FBI and USDA’s Office of Inspector General to investigate the possibility that a boat engine had been tampered with. USDA also asked the FBI to investigate why backup generators failed to come on when Plum Island lost power for more than 3 hours in December 2002. After the backup generators failed to provide power, New York’s ABC news station broadcast an interview with a disguised worker, at that time employed at Plum Island, who discussed his unhappiness with USDA and the contractor and blamed replacement workers for the power outage.In addition, several of the striking workers returned to work for LB&B Associates and are still employed on the island under the new contractor, North Fork Services. In response to the strike, USDA prevented striking workers from accessing Plum Island and it added guards at Orient Point to assure the security of employees as they were arriving and departing near the union picket line. However, USDA did not reevaluate the level of risk, the assets requiring protection, or its incident response plans in light of the strike and accompanying sabotage. USDA believed that this was not necessary because its security plan anticipated a disgruntled worker at any of its laboratories. We disagree because there is a difference between addressing security problems caused by one employee and addressing the hostilities resulting from the strike, which could include several employees working together. We believe that the implications of a disgruntled work force should be taken into account when reevaluating the extent of risks, threats, and assets requiring increased security. Furthermore, Sandia had originally recommended that USDA review the defined threats with the intelligence community and local law enforcement officials to ensure that threats particular to Plum Island and its vicinity were taken into consideration, but this was never done. FBI and Suffolk County officials told us that they consider this step to be very important because if there were such threats, federal and local officials may be aware of them and the risks they pose to the Plum Island Animal Disease Center. In addition, if local law enforcement entities were involved in planning Plum Island’s security, they would be in a better position to respond to incidents on the island. DHS officials agree that rehiring workers who walked off the job could be problematic but told us they are under pressure from the local chapter of the union and the community to rehire those who lost their jobs as a result of the strike. DHS officials also said they recognize the importance of working with local law enforcement and the intelligence community to better define the threats and associated risks for Plum Island. Regarding the contractor’s performance, despite a decline from the previous rating period, USDA rated LB&B Associates’ performance as superior for the rating period during which the strike occurred. When the strike occurred, LB&B Associates, with the assistance of USDA employees, maintained operations at Plum Island. For example, LB&B Associates implemented a strike contingency plan, brought in qualified individuals from its other work sites, and hired subcontractors with the required licenses and certifications to operate certain Plum Island facilities and its boats. Also, as a result of the strike, LB&B Associates exceeded its estimated budget by about $511,000, or approximately 5 percent, for fiscal year 2002 and the first quarter of fiscal year 2003. USDA was aware of and approved the cost increases. Further information about LB&B Associates’ performance, employee qualifications, and costs is contained in appendix III. Despite improvements, security arrangements at Plum Island are not yet sufficient. Further actions are needed to provide reasonable assurance that pathogens cannot be removed from the facility and exploited for use in bioterrorism. Until DHS fully implements the physical security measures and addresses those vulnerabilities identified by our Office of Special Investigations, Plum Island’s security system will not provide physical security commensurate with the importance of the facility. Additionally, the Plum Island Animal Disease Center will remain more vulnerable than it needs to be if the physical infrastructure that supports it is not afforded better protection. Similarly, it is important to better secure the foot-and- mouth disease vaccine bank to ensure its availability for combating an outbreak. Also, the lack of comprehensive policies and procedures for limiting access to pathogens unnecessarily elevates the risk of pathogen theft. Moreover, because physical security measures alone are not adequate to secure pathogens, all laboratories containing these materials face the challenge of developing other approaches to mitigate the risk of theft. By consulting with other laboratories to discover methods they are using to mitigate the risk to pathogens, Plum Island officials can learn more about safeguards being employed elsewhere. Furthermore, Plum Island officials cannot effectively respond to security breaches until DHS resolves issues that impede Plum Island’s response capability, such as the authority of the guard force to make arrests, which makes it difficult for the guards and local law enforcement agencies to address criminal situations on the island. Finally, because we believe the level of risk at Plum Island is higher than USDA originally determined, and because USDA did not validate threats with intelligence agencies or local law enforcement officials, DHS cannot be assured that Plum Island’s security, including its physical security system and response plans, is sufficient to address the full range of events that could occur on the island. To complete and enhance Plum Island’s security arrangements, we recommend that the Secretary of Homeland Security, in consultation with the Secretary of Agriculture, do the following: Correct physical security deficiencies by (1) fully implementing the physical security measures, (2) addressing the specific security shortcomings identified by our Office of Special Investigations, (3) better securing certain features of the physical infrastructure that supports the continued operation of the Plum Island Animal Disease Center, and (4) better securing the foot-and-mouth disease vaccine bank. Limit access to pathogens by further developing and enforcing specific procedures, including internal control checks, to ensure (1) that all individuals involved in laboratory activities in the biocontainment area—including students and regardless of citizenship—have been approved, in accordance with the law; (2) that background checks of these individuals are updated regularly; and (3) that cleaning, maintenance, and repair staff entering the biocontainment area are escorted at all times by individuals with completed background checks. Consult with other laboratories to identify ways to mitigate the inherent difficulty of securing pathogens. Enhance incident response capability by (1) resolving the issue of the guards’ authority to carry firearms and make arrests; (2) developing and implementing a policy on how guards should deal with intruders and use weapons; (3) increasing the size of the guard force; (4) completing an agreement with local law enforcement agencies to ensure backup assistance when needed; (5) defining an adequate response time for law enforcement to respond to incidents; (6) developing an incident response plan that includes precise detail about what to do in the event an incident occurs that exceeds the capability of the security system, such as a terrorist attack; and (7) conducting exercises with local law enforcement to test the efficiency and effectiveness of Plum Island’s response capability. Reconsider the security risks at Plum Island, taking into account recent acts of disgruntled employees. Consult with appropriate state and local law enforcement and intelligence agencies to revisit the threats specific to the Plum Island Animal Disease Center. Revise, as necessary, security and incident response plans to reflect any redefined, risks, threats, and assets. We provided DHS and USDA with a draft of this report for their review and comment. Both agencies provided written and clarifying oral comments. The agencies also provided technical comments, which we incorporated into the report as appropriate. Overall, DHS agreed with the report and stated that it has started to implement our recommendations, and USDA stated that the report was very useful but also raised several concerns. In its written comments (see app. IV), DHS agreed that fundamental concerns leave the facility vulnerable to security breaches and stated that the report is factually accurate. DHS also commented that it accepts and supports our recommendations. In addition, DHS stated that since it assumed administrative responsibility for Plum Island on June 1, 2003, it has taken the following actions, among others, to address the recommendations in this report: DHS is working with USDA to develop corrective actions to address the physical security deficiencies identified in our report. DHS is working with USDA to develop an access control policy for all personnel who are required to enter the biocontainment area. DHS is working with other federal agencies to develop security policies and procedures to limit access to pathogens. DHS is working with the Federal Protective Service to enhance security at the facility and bring arrest and detention authority to the island. In addition, DHS stated that funds have been requested to increase the guard force. DHS is working with local law enforcement agencies to coordinate incident response plans, mutual aid agreement requirements, and joint exercises to test security response capabilities. DHS is reviewing the island’s entire security plan and will revise the threat assessment as necessary. DHS stated that it expects to complete this assessment in early 2004. In its written comments (see app. V), USDA addressed several aspects of our report. These specific comments and our responses follow. USDA suggested that the report should make judgments about the need for enhanced security against a risk assessment-based approach that considers both the probability and the consequences of specific types of attacks. However, as we report, DHS is now responsible for performing such an assessment, and DHS stated that it has undertaken a review of USDA’s threat statement, which it will complete early in 2004. Our objective was to evaluate the status of security on Plum Island. That evaluation included, among other steps, a review of USDA’s risk-based security plan for Plum Island and its implementation. Our report details substantive flaws in both the planning and the execution of that plan. USDA also commented that the report did not recognize that USDA had a contract to improve security at Plum Island prior to September 11, 2001. We added to the report that USDA contracted with the U.S. Army Corps of Engineers in 2000 to improve security at Plum Island, but noted that few of the Corps’ recommendations had been implemented. Also, USDA officials told us that in light of September 11, 2001, and the subsequent dissemination of anthrax through the postal system, they made a concerted effort to improve security at USDA’s laboratories. The officials added that Sandia was hired to provide USDA with a consistent approach to evaluating security at the department’s major laboratories. Sandia officials told us that they did not agree with the approach taken by the Corps, and they concluded that Plum Island’s existing security system was substantially inadequate for protecting against the threats that USDA defined as relevant. USDA indicated that it took various actions to safeguard pathogens in response to the strike. USDA stated that it increased and armed the guards on Plum Island; added guards at Orient Point, Long Island, where the strikers were picketing; and excluded the strikers from Plum Island facilities. We agree that USDA responded with immediate measures and have revised the report to reflect these steps. However, we believe that USDA’s responses to the strike were insufficient. Although USDA increased the number of guards at Orient Point, this was a temporary measure primarily put in place to ensure the safety of the employees as they passed the union picket line. Also, Plum Island officials told us that the number of guards on Plum Island itself did not change as a result of the strike and that these guards had been armed since 2001. More importantly, USDA’s comments do not recognize that there is a difference between addressing security problems caused by one employee and addressing the security problems resulting from the strike, which could include several employees collaborating to cause problems. We believe that the implications of having a disgruntled work force should be taken into account when reevaluating the extent of risks, threats and assets requiring increased security. USDA stated that it appropriately used armed guards on Plum Island and were in communication with local law enforcement. While we agree that armed guards are necessary for security on Plum Island, our concern is that the guard force did not have authority from USDA to carry firearms and make arrests. Furthermore, USDA never developed a policy instructing its guards when and how they could use force, including the firearms they were carrying. Plum Island officials said they were unable to resolve these important matters with USDA headquarters officials, including the Office of General Counsel. Finally, we noted in the report that while Plum Island officials have communicated with local law enforcement, no agreement was reached to assist Plum Island guards in the event a criminal act occurred on the island. DHS stated that it is working to resolve these issues. USDA stated that it is an accepted practice for a person with an appropriate background investigation to escort those who do not yet have a clearance. USDA also acknowledged that it had problems implementing its escort procedures at Plum Island but now believes its escort procedures are reliable. We agree that the practice of escorting is used in other laboratories that contain pathogens. However, Plum Island officials and scientists repeatedly told us that this procedure is not practical at Plum Island because of staffing considerations. For example, they explained that the escorts were Plum Island employees who had other duties, which compelled them to leave those they were escorting for periods of time. Furthermore, we believe that internal control checks should be established to ensure implementation of escort procedures, and we have added this to our recommendations. DHS commented that more will be done to address this issue—it is planning to develop, in concert with USDA, a limited use policy to identify access control requirements for all personnel who are required to enter the biocontainment area. USDA said that several of the employees we identified had not had their background checks updated in the last 5 years, but that some of those we identified had. We reported based on the actual records of background checks maintained at the Plum Island Animal Disease Center. We also recognize that there may be differences between the records maintained on the island and other USDA records, and that the background checks of several of these individuals may have been updated since the time of our review. As we agreed with your office, unless you publicly announce the contents of this report earlier, we plan no further distribution of it until 30 days from the date of this report. We will then send copies of this report to the Secretaries of Homeland Security and Agriculture, appropriate congressional committees, and other interested parties. We will also make copies available at no charge on the GAO Web site at http://www.gao.gov. If you have any questions about this report, please call me or Charles M. Adams at (202) 512-3841. Key contributors to this report are listed in appendix VI. To determine the extent to which USDA has addressed security for Plum Island, we visited the facility several times to examine current physical security measures and to review plans for further security actions. In addition, two security experts from our Office of Special Investigations toured the facility to identify possible vulnerabilities and actions that could be taken to reduce them. We also reviewed numerous security documents, such as Sandia’s assessment of Plum Island security; Plum Island’s draft security and response plans; draft memorandums of understanding with local entities; physical security implementation plans; and policies and procedures for guards, employees, visitors, students, and others with access to pathogens. In addition, we worked closely with Sandia officials to understand how they applied a risk management security approach to Plum Island. We also interviewed numerous officials from Plum Island, including the physical security specialist, scientists, the center director, and others responsible for security changes under both the Agricultural Research Service and the Animal Plant and Health Inspection Service; officials of USDA’s Offices of Homeland Security, Procurement and Property Management, and General Counsel; and officials of the Department of Homeland Security, which assumed the administration of Plum Island. To gain a better understanding of possible threats to Plum Island, we spoke with officials from the Federal Bureau of Investigation, Defense Intelligence Agency, Central Intelligence Agency, Suffolk County police and fire departments, and USDA’s Office of Inspector General. To understand the cooperation between local governments and Plum Island that might be needed if an incident were to occur on the island, we interviewed government and law enforcement officials from Suffolk County, the town of Southold, and the village of Greenport. Finally, we toured the laboratories at and interviewed officials from the National Institutes of Health and the U.S. Army Medical Research Institute of Infectious Diseases to understand how they are handling security challenges since the terrorist attacks of 2001. To determine Plum Island’s compliance with new laws and regulations, we reviewed the USA Patriot Actof 2001, the Agricultural Bioterrorism Protection Act of 2002 and its regulations that went into effect as a final interim rule on February 11, 2003, as well as USDA’s policies and procedures for security at biosafety level 3 facilities. We also considered the Office of Management and Budget’s Circular A-123, Management Accountability and Control, and the standards in our Internal Control: Standards for Internal Control in the Federal Government. To determine how well LB&B Associates performed from the time the strike began on August 13, 2002, to January 5, 2003, we (1) reviewed LB&B Associates’ contract with USDA and identified LB&B Associates’ performance requirements; (2) interviewed officials of USDA, LB&B Associates, and the International Union of Operating Engineers to get their perspective on LB&B Associates’ performance; (3) reviewed USDA’s ratings of LB&B Associates’ performance since 1999 and, in particular, the Award Fee Determination Board’s report on LB&B Associates’ performance during the period the strike took place; (4) reviewed the qualifications of LB&B Associates employees, such as the boat operators and water distribution and treatment system operators, all of whom are required to meet certain qualifications for performing their duties; (5) analyzed 3 years of contract cost data provided by LB&B Associates to learn which items increased as a result of the strike; and (6) validated the contract cost data by spot-checking it against the bills LB&B Associates submitted to USDA. While we took these steps to determine how well LB&B Associates performed, we did not independently rate LB&B Associates’ performance. In addition, we interviewed officials involved in investigating strike-related incidents, including officials of the Federal Bureau of Investigation and USDA’s Office of Inspector General. Our work was conducted in accordance with generally accepted government auditing standards from January through August 2003. The security force reports directly to the Administrative Contract Officer and not to the Security Director—it is important for the security force to report directly to the Security Director of Plum Island to ensure that security-related issues are handled promptly. There are no name checks or record checks given to contractors and visitors going into the biocontainment area. Contractors and visitors entering the biocontainment area could be checked for criminal charges (through the National Criminal Information Center) before they are granted access. The area outside of the biocontainment and administrative building is surveilled by stationary closed-circuit television cameras, which are insufficient. Installing pan, tilt, and zoom closed-circuit television cameras in certain areas would enhance surveillance capabilities. The island is easily accessible to the general public by boat, and there are limited “no trespassing” signs present on the island to advise the public that it is a government facility—more “no trespassing” signs in those areas of the island that are easily accessible to the public by boat would address this condition. In the event of a fire, Plum Island is not always able to respond appropriately because the fire brigade has limited hours of operation. The security force could be cross-trained for fire rescues and therefore provide 24-hour coverage. The building used for overnight accommodations lacks panic alarms for emergency response. Panic alarms could be installed in the building and, when visitors are present, security guards could drive by on a regular basis. Control for keys and master keys of the facility is deficient. The security department could be assigned the responsibility for all keys and master keys. A key log could be created to better track possession of keys. USDA concluded, in an evaluation of LB&B Associates’ performance, which included the time period involving the strike, that LB&B Associates’ overall performance was superior, although its performance had declined compared to prior rating periods. When the strike occurred, LB&B Associates, with the assistance of USDA employees, continued to perform and maintained operations at Plum Island. LB&B Associates implemented a strike contingency plan, brought in qualified individuals from its other work sites, and hired subcontractors with the required licenses and certifications to operate certain Plum Island facilities and its boats. Also, as a result of the strike, LB&B Associates exceeded its estimated budget by about $511,000, or approximately 5 percent, for fiscal year 2002 and the first quarter of fiscal year 2003. USDA was aware of and approved the cost increases. Although LB&B Associates’ performance declined during the strike relative to previous rating periods, overall, LB&B Associates performed at a superior level during the evaluation period that included several months when workers were on strike, maintaining—and in some cases even improving—operations critical to the functioning of the island, according to Plum Island officials. Plum Island’s Award Fee Determination Board regularly rated LB&B Associates’ performance using a system described in its contract to calculate a composite performance score. According to the board, LB&B Associates’ performance was outstanding—the highest level—for more than 2 years, until the rating period in which the strike began. The board faulted LB&B Associates in several rating categories resulting in a decline in its performance rating. For example, according to the board, LB&B Associates’ strike contingency plan, which describes how essential operations would be continued in the event of a strike, was outdated. As a result, implementation of the plan was slowed because it took up to 48 hours before all of its temporary workers arrived on the island. Moreover, some subcontracts cost more than anticipated. According to the board, LB&B Associates overcame initial problems in implementing its contingency plan and, overall, performed at the superior level. For example, temporary workers and subcontractors hired by LB&B Associates quickly repaired the water system that had been sabotaged on the first day of the strike. Furthermore, according to the board, some activities improved after the onset of the strike, including the maintenance of steam pipes, an important component of the process used to decontaminate laboratory waste contaminated with pathogens. Also, boat maintenance and cafeteria services—both of which, according to the Board, had been problematic before the strike—improved after replacement workers were hired. Figure 2 shows the composite scores the board gave LB&B Associates from fiscal year 2000 through the first quarter of fiscal year 2003, which includes the time during which the strike occurred. More details about how the board evaluated LB&B Associates’ performance are contained in table 1. To maintain operations at Plum Island after the strike began, LB&B Associates brought in temporary replacements from some of its other contract sites, hired subcontractors, and subsequently hired permanent replacement workers, as described in the strike contingency plan. We confirmed that workers in certain positions, including boat operators and operators for the wastewater treatment system, were licensed as prescribed by LB&B Associates’ contract with USDA. In addition, many of the replacement workers appear to have significant and relevant work experience for the positions for which they were hired. Although LB&B Associates and USDA staff worked together to maintain vital functions, operations were affected at times by the strike because of the reduced workforce and the loss of some workers with specific skills and/or qualifications. For example, the ferries that take workers to and from the island operated on a reduced schedule until all three boat masters who had walked out were replaced by individuals with the necessary Coast Guard license. Also, some USDA officials stepped in to fulfill duties that were normally performed by qualified contract staff, such as monitoring the air filters in the laboratory, until qualified replacements were hired. By July 2003, most positions left vacant by the strike were filled, most of them by permanent replacement workers and 16 by striking workers who returned to work on the island. With USDA’s approval, LB&B Associates exceeded its estimated budget by about $511,000, or approximately 5 percent, during the 15-month period covering fiscal year 2002 and the first quarter of fiscal year 2003, the period during which the strike began. USDA allowed the additional expenditures, which occurred in the last 2 months of fiscal year 2002 and the first 3 months of 2003, because it recognized that the strike would result in higher expenses and it found LB&B Associates’ estimate for exceeding the budget to be acceptable, under the circumstances. As required by Federal Acquisition Regulations, LB&B Associates notified USDA that it expected to exceed its budget as a result of the strike.Figure 3 shows the total costs LB&B Associates charged to USDA from October 1, 2001 through January 5 2003; the graph also incorporates costs billed to USDA by North Fork Services from January 6 through May 31, 2003, illustrating the continued fluctuation in contract costs. According to LB&B Associates’ data, there were fluctuations in Plum Island’s costs, as shown in figure 3. Also, as a result of the strike, additional costs were incurred in the following areas from August 1, 2002, through January 5, 2003,unless otherwise noted: labor (salary and benefits), subcontracts, cafeteria, and travel (including lodging and transportation). Labor: The cost of labor peaked at $428,161 in August 2002, a 16 percent increase over the average monthly cost of $370,118 for the previous 10 months. Monthly labor costs then gradually decreased until November, when the cost of labor was about 1.6 percent more than the average monthly cost. Labor costs increased because most of the temporary replacements were management-level employees from other LB&B Associates contract sites, who earned more than the employees they replaced. According to its documents, LB&B Associates used management-level employees because union members from other localities usually honor a picket line and would not temporarily replace union strikers. As new permanent employees were hired, the cost of labor gradually decreased. Subcontracts: Subcontracts related to the strike, such as for providing security guards at the picket line, added about $523,000,or 77 percent of the total subcontract costs billed to USDA by LB&B Associates. Cafeteria: Cafeteria expenses increased by about $12,000, or 51 percent of the total cafeteria expenses because the cafeteria provided two meals per day for the temporary replacements, who spent more time on the island to ensure continued operations than employees had before the strike began. Travel: Travel expenses attributed to the strike, such as transporting and housing the temporary replacement workers, totaled more than $125,000, constituting 98 percent of the total travel costs billed to USDA during that time period. In addition to the individual named above, Aldo Benejam, Nancy Crothers, Mary Denigan-Macauley, Jonathan Gill, Thomas Farrell, Wyatt R. Hundrup, and Ramon Rodriguez made key contributions to this report. The General Accounting Office, the audit, evaluation and investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO’s commitment to good government is reflected in its core values of accountability, integrity, and reliability. The fastest and easiest way to obtain copies of GAO documents at no cost is through the Internet. GAO’s Web site (www.gao.gov) contains abstracts and full- text files of current reports and testimony and an expanding archive of older products. The Web site features a search engine to help you locate documents using key words and phrases. You can print these documents in their entirety, including charts and other graphics. Each day, GAO issues a list of newly released reports, testimony, and correspondence. GAO posts this list, known as “Today’s Reports,” on its Web site daily. The list contains links to the full-text document files. To have GAO e-mail this list to you every afternoon, go to www.gao.gov and select “Subscribe to e-mail alerts” under the “Order GAO Products” heading.

Summary: Scientists at the Plum Island Animal Disease Center are responsible for protecting the nation against animal diseases that could be accidentally or deliberately introduced into the country. Questions about the security of Plum Island arose after the 2001 terrorist attacks and when employees of the contractor hired to operate and maintain the Plum Island facilities went on strike in August 2002. GAO reviewed (1) the adequacy of security at Plum Island and (2) how well the contractor performed during the strike. The Department of Homeland Security (DHS) assumed the administration of Plum Island from the Department of Agriculture (USDA) on June 1, 2003. While DHS is now responsible for Plum Island, USDA is continuing its research and diagnostic programs. Security at the Plum Island Animal Disease Center has improved, but fundamental concerns leave the facility vulnerable to security breaches. First, Plum Island's physical security arrangements are incomplete and limited. Second, Plum Island officials have been assuming unnecessary risks by not adequately controlling access to areas where pathogens are located. Controlling access is particularly important because pathogens are inherently difficult to secure at any facility. Although this risk may always exist, DHS could consult with other laboratories working with pathogens to learn different approaches to mitigate this risk. Third, Plum Island's security response has limitations. For example, the guard force has been armed but has not had the authority from USDA to carry firearms or make arrests. Moreover, Plum Island's incident response plan does not consider the possibility of a terrorist attack. Fourth, the risk that an adversary may try to steal pathogens is, in our opinion, higher at the Plum Island Animal Disease Center than USDA originally determined because of hostilities surrounding the strike. Also, when USDA developed its security plan for Plum Island, it did not review their defined threats with the intelligence community and local law enforcement officials to learn of possible threats--and their associated risks--relevant to the Plum Island vicinity. Although these reviews did not occur, USDA subsequently arranged to receive current intelligence information. Despite a decline in performance from the previous rating period, USDA rated the contractor's performance as superior for the rating period during which the strike occurred.