DHS’s NPPD leads the national effort to protect and enhance the resilience of the nation’s physical and cyber infrastructure. The directorate includes the Office of Infrastructure Protection, which leads the coordinated national effort to reduce risk to U.S. critical infrastructure posed by acts of terrorism. Within the Office of Infrastructure Protection, ISCD leads the nation’s effort to secure high-risk chemical facilities and prevent the use of certain chemicals in a terrorist act on the homeland, as well as implementing CFATS and managing the CFATS program, including its whistleblower process and procedures. The CFATS program is intended to ensure the security of the nation’s chemical infrastructure by identifying, assessing the risk posed by, and requiring the implementation of measures to protect high-risk chemical facilities. Section 550 of the DHS Appropriations Act, 2007, required DHS to issue regulations establishing risk-based performance standards for chemical facilities that, as determined by DHS, present high levels of risk; the act also required vulnerability assessments and development and implementation of site security plans for such facilities. DHS published the CFATS interim final rule in April 2007 and appendix A to the rule, published in November 2007, lists 322 COI and the screening threshold quantities for each. According to DHS, subject to certain statutory exclusions, all facilities that manufacture COI as well as facilities that store or use such chemicals as part of their daily operations may be subject to CFATS. However, only chemical facilities determined to possess a requisite quantity of COI (that is, the screening threshold quantity) and subsequently determined to present high levels of security risk—that is, covered facilities—are subject to the more substantive requirements of the CFATS regulation. The CFATS Act of 2014 amended the Homeland Security Act of 2002 by adding the Chemical Facility Anti-Terrorism Standards as Title XXI and, in effect, authorizing the program for an additional 4 years. Among other things, the act expressly repeals DHS’s authority to implement the program under section 550 of the DHS Appropriations Act, 2007, but also expressly provides that the CFATS regulation promulgated under that authority shall remain in effect unless otherwise amended, consolidated, or repealed. Consequently, while the act imposes new and additional responsibilities on DHS to implement the CFATS program, including a whistleblower procedure, the program continues to be implemented by ISCD under the existing regulatory framework. For more information about the CFATS regulation and process, see appendix II. According to the CFATS Act of 2014, among other things, DHS is to implement the following six provisions related to a whistleblower procedure: 1. not later than 180 days after the date of enactment of the CFATS Act of 2014, establish and provide information to the public regarding a procedure under which any employee or contractor of a chemical facility of interest may submit a report of a CFATS violation, 2. keep confidential the identity of an employee or contractor at a chemical facility of interest, who submits a report of a potential CFATS violation under the established whistleblower procedure, 3. promptly respond to an employee or contractor at a chemical facility of interest, who provides contact information, to acknowledge receipt of the report, 4. review and consider the information provided in any report submitted, and take action, as appropriate, to address any substantiated CFATS violation, 5. follow certain procedural requirements if the Secretary determines that a violation has occurred and decides to institute a civil enforcement or issue an emergency order against a chemical facility, as appropriate under the law, and 6. work in partnership with industry associations and labor organizations to make publicly available, physically and online, the rights that an individual who provides DHS with whistleblower information about a covered chemical facility, would have under federal law. In addition, the CFATS Act of 2014 provides that an owner or operator of a chemical facility of interest may not discharge or otherwise discriminate against an employee or contractor because of submitting a report to DHS of a CFATS violation. According to DHS officials, to meet the definition of a whistleblower report under the CFATS Act of 2014, the report must be from an employee or contractor at a chemical facility of interest and involve a potential CFATS violation. A CFATS violation is when officials at a chemical facility of interest violate a provision of the CFATS Act of 2014 or CFATS regulations, such as knowingly submitting false information to DHS or failing to maintain appropriate records. From June 16, 2015 (when ISCD implemented its whistleblower process) to April 19, 2016, ISCD received 105 reports from individuals—90 via the ISCD telephone tip line, 14 via e-mail, and 1 from ISCD’s CFATS help desk. ISCD officials determined that 8 of the 105 reports were potential CFATS violations and, after further review, that 1 of the 8 reports involved a CFATS violation. For the report that ISCD determined was a CFATS violation, ISCD took action against the chemical facility by requiring it to register with ISCD pursuant to requirements of the CFATS program. ISCD officials determined that 97 of the 105 reports were not potential CFATS violations and closed the reports because they did not pertain to requirements under the CFATS program. The most common types of reports that ISCD officials determined were not potential CFATS violations involved allegations of suspicious or illegal activity not related to CFATS. Additionally, the majority of the reports were submitted by concerned individuals, not employees or contractors at chemical facilities; therefore, the individuals were not whistleblowers as defined by DHS. However, ISCD officials also review and address reports from individuals who are outside of the statutory definition. ISCD officials referred 70 of the 97 reports (72 percent) to other federal agencies or departments consistent with ISCD’s interim process for addressing reports, which states that certain reports are to be referred to other agencies or departments. For example, reports related to terrorism are to be referred to the Federal Bureau of Investigation (FBI) Washington Field Office, and reports related to environmental or community safety are to be referred to the EPA. Of the 70 reports that ISCD referred to other federal agencies or departments, 63 reports (90 percent) related to terrorism and other allegations of criminal activity were referred to the FBI. Figure 1 illustrates the number and percentage of reports that ISCD received from June 16, 2015 through April 19, 2016, and the disposition for the 97 reports that ISCD officials determined did not involve potential CFATS violations. In addition to the 105 reports that ISCD received from June 16, 2015 to April 19, 2016, ISCD received 345 calls from February 2009—when ISCD created its telephone tip line for potential CFATS violations—to June 15, 2015 (the day before ISCD implemented its interim process for addressing CFATS whistleblower reports). See appendix III for our analysis of the 345 calls. Of the 105 reports, ISCD further reviewed 8 reports (8 percent) that officials determined to involve potential CFATS violations. ISCD officials determined that, for one of the eight reports, the chemical facility met threshold requirements for COI and, therefore, the chemical facility had violated CFATS for failure to submit required CFATS documentation to ISCD. Specifically, a concerned individual, who was not an employee or contractor of a chemical facility, submitted a report about a commercial propane facility near a residential area. The individual cited concerns about the facility’s lack of security and expressed fear of a catastrophic event if the facility was not in compliance with DHS’s security regulations. ISCD followed-up with the individual to obtain more information and contacted the facility to obtain information about the quantity of COI at the facility. ISCD determined that a CFATS violation had occurred because the facility met the threshold reporting requirements, but had not registered with ISCD. In addition, ISCD determined that the company had seven other facilities that should have registered with ISCD. ISCD closed the report without pursuing civil enforcement action because the facility submitted required CFATS documentation after ISCD directed the facility to do so. ISCD determined that six of the eight reports were not CFATS violations because the chemical facilities or issues reported were not subject to CFATS regulations. For example, for four reports, ISCD found that the facilities did not have sufficient quantities of COI to meet threshold regulatory requirements. The remaining report is still open because ISCD officials have not completed their investigation. Table 1 describes the eight reports that ISCD further reviewed to determine whether they were CFATS violations. In response to the CFATS Act of 2014, ISCD developed a documented, interim process to address reports of potential CFATS violations, and implemented the process on June 16, 2015. Figure 2 illustrates the process and its key procedures. Our analyses of ISCD’s efforts related to implementing a whistleblower procedure show that, since June 16, 2015, ISCD has had an interim process and procedures for all six related provisions for DHS in the CFATS Act of 2014. Our analyses also show that ISCD has implemented its interim process and procedures for five of the six provisions. ISCD officials stated that there has not been a need to implement the remaining provision—to follow certain procedural requirements if the Secretary determines that a violation has occurred and decides to institute a civil enforcement or issue an emergency order. Specifically, from June 16, 2015 to April 19, 2016, there was one whistleblower report that they substantiated, but it did not result in a civil enforcement or emergency order because the chemical facility took the action that ISCD required. Table 2 lists the results of our assessment of ISCD’s efforts since June 16, 2015 to develop and implement a whistleblower process and procedures for the six related provisions for DHS in the CFATS Act of 2014. For a more detailed description of ISCD’s efforts to develop and implement a whistleblower process and procedures, see appendix IV. Regarding ISCD’s specific efforts to implement the five provisions, ISCD officials told us that, for two provisions, they maintained the confidentiality of each individual’s identity, and worked in partnership with industry associations and labor organizations to make publicly available the rights that an individual, who provides whistleblower information about a covered chemical facility, would have under federal law. Based on our analysis of ISCD’s documentation for reports from individuals who provided their contact information, we did not see any indication that ISCD breached individuals’ confidentiality. We interviewed officials in the three industry associations and three labor organizations, who ISCD officials reached out to, and the industry and labor officials stated that ISCD officials worked in partnership with them to publicize whistleblower protections and rights. In addition, our analyses indicate that ISCD implemented the other three provisions by implementing its interim process and procedures for addressing whistleblower reports, providing acknowledgment receipts to individuals, who provided their contact information and submitted reports that DHS determined to involve potential CFATS violations, and reviewing and considering the information provided in the reports. ISCD officials stated that they are developing formal standard operating procedures to address reports of potential CFATS violations and the formal procedures were expected to be implemented by the end of June 2016. The formal procedures will supersede the interim procedures. The CFATS Act of 2014 prohibits retaliation against whistleblowers, but DHS lacks a process and procedures to address whistleblower retaliation reports, according to DHS officials. Specifically, an owner or operator of a chemical facility of interest or agent may not discharge an employee or otherwise discriminate against an employee with respect to the compensation provided to, or terms, conditions, or privileges of the employment of, the employee, for reporting a potential CFATS violation to DHS. DHS officials stated that DHS has authority under the CFATS Act of 2014 to issue an administrative order against a chemical facility of interest that violates the act, including for retaliating against a whistleblower. If chemical facility officials do not comply with the order, DHS has authority to issue a civil penalty of up to $25,000 for each day the facility is not in compliance. As of April 2016, DHS did not have documented procedures to investigate whether whistleblower retaliation had occurred, according to DHS officials. DHS has not received a whistleblower retaliation report that it substantiated since ISCD implemented the interim process for whistleblower reports on June 16, 2015. ISCD officials said they do not plan to include a process and procedures to investigate future retaliation reports in the formal, standard operating procedures for addressing whistleblower reports, which were expected to be implemented by the end of June 2016. However, DHS officials stated that a process to address retaliation reports would be useful and that DHS intends to conduct rulemaking to develop a formal process and procedures. The officials stated that, in the meantime, they would address any future retaliation reports on a case-by-case basis. Vetting future retaliation reports on a case-by-case basis may not provide adequate assurance that ISCD can effectively and efficiently investigate and respond to reports of retaliation. Standards for Internal Control in the Federal Government states that management should document the responsibilities of the organization in policies, so that personnel can carry out control activities for their assigned responsibilities. Without a documented process and procedures for investigating and responding to whistleblower retaliation reports, ISCD officials risk making ad hoc decisions that may not help ensure consistent and appropriate use of ISCD’s authority to issue administrative orders and penalties against the chemical facility. DHS officials stated that, during 2015, they met with officials in the Department of Labor’s Occupational Safety and Health Administration (OSHA), Environmental Protection Agency (EPA), and Nuclear Regulatory Commission to discuss and learn about, among other things, the three agencies’ procedures to address whistleblower retaliation reports and mechanisms to enforce protections against whistleblower retaliation. OSHA officials told us that they provided DHS officials with an overview of the process that OSHA uses in its program to protect whistleblowers from retaliation. DHS officials stated that they are considering what they learned from OSHA, EPA, and the Nuclear Regulatory Commission as DHS matures its CFATS whistleblower process, including how to address any future whistleblower retaliation reports. Although it is not yet available for DHS to use, OSHA has developed draft guidance with recommended practices for public, private, and non-profit employers to use in preventing and addressing whistleblower retaliation, which OSHA expects to publish in fall 2016. While the guidance is intended for employers, it could be useful for consideration when developing a whistleblower retaliation function within a regulatory program such as CFATS. The practices are based on recommendations unanimously agreed upon by the Secretary of Labor’s Whistleblower Protection Advisory Committee. OSHA’s recommended practices include five steps for creating an effective anti-retaliation program: (1) ensure leadership commitment, (2) foster an anti-retaliation culture, (3) implement a system to respond to reports of retaliation, (4) conduct anti-retaliation training, and (5) monitor progress and program improvement. To implement a system to respond to reports of retaliation, the OSHA draft guidance recommends, among other things, using an objective, independent report review process, focusing on the facts and underlying concern rather than on defending against the claim, and listening to all sides before making a judgment. Leveraging recommended practices, such as those to be published by OSHA, could help ISCD officials take advantage of lessons learned by other whistleblower program managers. However, until DHS establishes a documented process and procedures that could include what was learned from these other agencies, DHS officials will have an ad hoc process for investigating retaliation. The ISCD current telephone tip line greeting and ISCD website for CFATS whistleblower reports provide no guidance and limited guidance, respectively, to whistleblowers regarding the types of information that would be most useful to ISCD in vetting and determining next steps for the reports. ISCD received almost all of the reports of potential CFATS violations via its telephone tip line and e-mail address, which are included on the ISCD website for CFATS whistleblower reports. In the automated greeting played when a whistleblower calls the telephone tip line to submit a verbal report, as described in the transcription of the greeting below, there is no specific guidance given to the whistleblower about the types of information to provide in the report. Thank you for calling the CFATS Chemical Facility Security Tip line. If you would like to report a possible security concern involving the Chemical Facility Anti-Terrorism Standards (CFATS) regulation at your facility or another facility, you may do so by leaving a message after the tone. You are welcome to report these concerns anonymously, or, if you would like a return call, please leave your name and number. If you are calling to report a potential security incident that has already occurred, please call the National Infrastructure Coordination Center at 202-282-9201. If you have a security emergency or terrorist incident, please hang up and call the FBI or 911 immediately. If you have questions about CFATS generally, please call 866-323-2957. The ISCD website states the following with regard to the types of information that a whistleblower should provide. For anonymous reports, please provide a detailed description of the nature of the potential violation, including, where possible, names and dates. ISCD officials stated that there are no current plans to add guidance to the telephone tip line greeting and on the website about the types of information that would be most helpful to ISCD; however, the officials said that adding guidance would be helpful. Our analysis of 105 reports received by ISCD from June 16, 2015 to April 19, 2016 identified the following challenges that ISCD officials experienced in vetting reports due to insufficient information. Of the 105 reports, ISCD identified 8 reports as potential CFATS violations. One of the eight reports did not include the name or location of the chemical facility. ISCD officials told us that the name and location of the chemical facility are two of the most important pieces of information in vetting a report that ISCD determines to be a potential CFATS violation. ISCD officials followed up with the individual to obtain the location of the chemical facility and information about the owner/operator of the facility. The individual provided ISCD with the address and owner of the chemical facility. ISCD used this additional information to further review the report and determined that a CFATS violation had occurred. Without this additional information, ISCD officials would not have had sufficient information to determine whether a CFATS violation occurred, and would have missed the opportunity to appropriately address the report and take action against the facility for CFATS non-compliance. Of the 105 reports, 62 were submitted from individuals who provided their contact information. ISCD officials followed up on 13 of the 62 reports (about 21 percent) to obtain additional information to help ISCD officials determine whether the reports were potential CFATS violations. Nine of the 13 individuals responded to ISCD’s request for additional information. However, ISCD officials were unable to reach the remaining four individuals to obtain needed information and, consequently, closed the reports without being able to determine if they involved potential CFATS violations. Of the 105 reports, 43 were submitted from anonymous individuals who did not provide contact information. ISCD officials stated that they were unable to determine if a CFATS violation had occurred for some reports from anonymous individuals due to insufficient information. Standards for Internal Control in the Federal Government calls for agencies to identify the information requirements needed and communicate these needs internally and externally to achieve the entity’s objectives. Additional guidance on the ISCD telephone tip line and ISCD whistleblower website could help ensure that individuals who submit reports are aware of the types of information to include in the report and, thus, reduce the amount of ISCD follow-up with individuals due to insufficient information and enhance information available to ISCD officials for determining if CFATS violations occurred. Furthermore, providing additional guidance to whistleblowers about the types of information most needed by ISCD could help to decrease the number of reports that ISCD closes without being able to determine whether CFATS violations occurred. The CFATS Act of 2014 required a procedure for whistleblowers to submit reports about potential CFATS violations at chemical facilities, including prohibiting retaliation against whistleblowers. However, DHS has not developed a documented process and procedures to investigate whether retaliation has occurred. A documented process and procedures for addressing and investigating whistleblower retaliation reports would better ensure that DHS can effectively and efficiently investigate reports to determine whether whistleblowers were retaliated against. DHS has limited guidance on its whistleblower website and no guidance on its telephone tip line greeting regarding the types of information that DHS needs from individuals who submit reports of potential CFATS violations. Without providing additional guidance to individuals, DHS officials may miss opportunities to obtain the information needed to determine if CFATS violations occurred or to do so without conducting follow-up efforts. This specific guidance will help assist DHS in collecting the information needed to properly investigate whistleblower reports and make informed decisions about whether CFATS violations have occurred. To help ensure that whistleblower retaliation reports are addressed efficiently and effectively, we recommend that the Secretary of Homeland Security direct the Under Secretary of NPPD, the Assistant Secretary for Infrastructure Protection, and the Director of ISCD to develop a documented process and procedures to address and investigate whistleblower retaliation reports that could include existing practices, such as OSHA’s recommended practices, in developing the process and procedures. To assist DHS in collecting the information needed to investigate whistleblower reports and make informed decisions, we recommend that the Secretary of Homeland Security direct the Under Secretary of NPPD, the Assistant Secretary for Infrastructure Protection, and the Director of ISCD to provide additional guidance on the ISCD whistleblower website and telephone tip line greeting to clearly communicate the information needed in the reports. We provided a draft of this report to DHS and relevant excerpts of this report to the Department of Labor/OSHA, EPA, and the U.S. Nuclear Regulatory Commission for their review and comment. DHS provided written comments, which are reproduced in full in appendix V. DHS also provided technical comments on our draft report and the Department of Labor/OSHA provided technical comments on the relevant excerpts of our draft report, which we incorporated as appropriate. The EPA and U.S. Nuclear Regulatory Commission did not have comments on the relevant excerpts of our draft report. DHS concurred with both of our recommendations and described actions planned to address them. Regarding our recommendation that DHS develop a documented process and procedures to address and investigate whistleblower retaliation reports that could include existing practices, such as OSHA’s recommended practices, DHS stated that due to the construction of the CFATS-authorizing legislation, developing formal processes and procedures for investigating whistleblower retaliation reports will require modifications to the CFATS regulations. According to DHS, rulemaking typically involves multiple steps over a considerable length of time and developing a thorough whistleblower retaliation investigation process and procedures will likely take a number of years. DHS noted that the OSHA guidance with recommended practices for addressing whistleblower retaliation complaints is not yet final, so establishing a formal whistleblower retaliation investigation process prior to the publication of OSHA’s guidance on the subject may be premature. However, DHS stated that while awaiting finalized guidance from OSHA, NPPD’s ISCD will begin moving forward to initiate the whistleblower retaliation-related rulemaking activities, and develop an interim process and procedures that will enable the department to consistently handle any whistleblower retaliation complaints received during the rulemaking process. These actions, if fully implemented, should address the intent of the recommendation. For our recommendation that DHS provide additional guidance on the ISCD whistleblower website and telephone tip line greeting, DHS stated that providing additional guidance to potential whistleblowers regarding the types of information most useful in assessing a potential CFATS violation is likely to increase the quality of the reports received, and enable a more efficient and effective evaluation and investigation of them. DHS also stated that ISCD will update the automated greeting on the CFATS tip line and the ISCD webpage with additional guidance and instructions for potential whistleblowers. These actions, if fully implemented, should address the intent of the recommendation. We are sending copies of this report to interested congressional committees and the Secretaries of Homeland Security and Labor, as well as the Administrator of EPA and the Executive Director for Operations for the U.S. Nuclear Regulatory Commission. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (404) 679-1875 or CurrieC@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in appendix VI. Our objectives were to determine (1) the number and types of Chemical Facility Anti-Terrorism Standards (CFATS) whistleblower reports the Department of Homeland Security (DHS) received, and any actions DHS took as a result of the reports, and (2) the extent to which DHS has implemented and followed a process to address reports from the whistleblowers, including reports of retaliation against whistleblowers. To determine the number and types of reports that DHS received, and any actions DHS took as a result of the reports, we reviewed all reports that DHS’s Infrastructure Security Compliance Division (ISCD) received from June 16, 2015 to April 19, 2016. Specifically, we reviewed the content of the 105 reports that ISCD received on the telephone tip line and by e-mail to identify the types of issues reported. We also interviewed ISCD officials, who were responsible for vetting and deciding what to do with these reports, about any actions taken to address the reports. In addition, we reviewed documentation from ISCD, such as the electronic spreadsheet for recording and tracking the reports, and documentation between the individuals who submitted the reports and ISCD, to evaluate ISCD’s actions from initial receipt of the reports to determining whether or not CFATS violations had occurred. We assessed the reliability of the data for the reports by, for example, reviewing ISCD’s standard operating procedures for receiving and documenting CFATS reports received on the telephone tip line and by e-mail, and interviewing knowledgeable officials to identify internal controls to ensure the completeness and accuracy of the information in the electronic spreadsheet. We determined the data to be sufficiently reliable for purposes of determining the number and types of reports received by ISCD. Although we focused on analyzing reports that DHS received since June 16, 2015, for context, we reviewed the CFATS telephone tip line calls that ISCD received from February 2009, when the telephone tip line started, to June 15, 2015—the day prior to ISCD’s implementation of the whistleblower procedure required under the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014 (CFATS Act of 2014). We analyzed the tip line calls to identify the types of issues reported and any DHS actions to address the calls. Specifically, we reviewed the transcriptions for 345 telephone tip line calls received and analyzed the content of the calls to identify those that may have been related to a potential CFATS violation, and to summarize the types of issues reported. We identified the key characteristics of the calls and categorized them as either not related to a CFATS violation or involving a potential CFATS violation. For those categorized as involving a potential CFATS violation, we categorized them into two sub-categories—either they potentially involved CFATS non-compliance, or they involved suspicious or illegal activity related to a chemical facility. Our analysis was limited to the content of the transcribed calls. ISCD has limited documentation on actions taken to address the calls received prior to June 16, 2015. Therefore, we were unable to review ISCD’s decisions on these calls, and our analysis does not include actions taken or decisions made by ISCD. However, our analysis is intended to provide perspective on the extent to which the calls were CFATS related and some examples of the types of issues that were reported to DHS prior to the implementation of the whistleblower process in response to the mandate in the CFATS Act of 2014. We assessed the reliability of the data for the calls by, for example, reviewing ISCD’s standard operating procedures for receiving and documenting CFATS tip line calls and interviewing knowledgeable officials and reviewing guidance to understand how the calls are received and transcribed. We determined the data to be sufficiently reliable for purposes of determining the number of calls received by ISCD and the types of issues reported. To determine the extent to which DHS implemented and followed a process to address reports from CFATS whistleblowers, we reviewed the CFATS Act of 2014, the Infrastructure Security Compliance Division Interim Process for Addressing Reports of Potential Chemical Facility Anti-Terrorism Standards (CFATS) Violations, and ISCD’s spreadsheet which documents ISCD officials’ review, actions taken, and decisions about each CFATS report received since June 16, 2015, when ISCD implemented its interim process. We also reviewed ISCD’s guidance for submitting a whistleblower report on ISCD’s telephone tip line and CFATS whistleblower website. We identified provisions related to whistleblower protections in the CFATS Act of 2014, and analyzed ISCD’s interim process for addressing reports of potential CFATS violations to determine if ISCD has a process and procedures for each applicable provision in the CFATS Act of 2014, and implemented its process and procedures since June 16, 2015 for each applicable provision in the CFATS Act of 2014. We interviewed DHS officials responsible for vetting and making decisions about reports received from June 16, 2015 to April 19, 2016 (the date of ISCD’s last data update to us). To better understand DHS’s process for addressing these reports, we reviewed the electronic tracking spreadsheet that ISCD officials use to document the reports, including actions taken to address them and the disposition of the reports. We used this information to evaluate ISCD’s efforts to implement the process and procedures to address each provision of the CFATS Act of 2014, including, for example, acknowledging receipt of the report and informing individuals of their whistleblower rights. We also analyzed information and interviewed DHS officials about factors that could affect how reports were addressed, such as the process for addressing reports received from individuals who did not meet DHS’s definition of a whistleblower, and reports that did not involve CFATS violations, as well whether there were any reports of retaliation against whistleblowers and how DHS would process such reports. In addition, we interviewed the lead official for ISCD’s telephone tip line and analyzed documents for the tip line at Oak Ridge National Laboratory in Tennessee about the process used to receive calls, transcribe them, and e-mail them to ISCD headquarters since February 2009. We compared ISCD’s interim process against Standards for Internal Control in the Federal Government to identify the extent to which DHS’s process was in alignment with these standards. In addition, to identify practices that are used to address whistleblower reports and reports of retaliation in comparable federal settings, we interviewed officials who DHS had consulted with at the Department of Labor’s Occupational Safety and Health Administration (OSHA), Nuclear Regulatory Commission, and Environmental Protection Agency, and analyzed related documents, including OSHA’s draft paper on recommended practices for employers for preventing and addressing retaliation. To determine if DHS worked in partnership with industry associations and labor organizations to inform them of ISCD’s whistleblower process and related whistleblower rights under federal law, and to obtain industry and labor perspectives on ISCD’s interim process for addressing reports of potential CFATS violations, we interviewed officials from ISCD and all six industry associations and labor organizations that ISCD officials told us they met with. The industry associations were three sector coordinating councils— Chemical, Food and Agriculture, and Oil and Natural Gas. The labor organizations were the International Brotherhood of Teamsters, International Chemical Workers Union Council, and United Steelworkers Union. The information we gathered from these six organizations is not generalizable, but provides perspectives on ISCD’s coordination with them regarding ISCD’s whistleblower process. We conducted this performance audit from September 2015 to July 2016 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. The Chemical Facility Anti-Terrorism Standards (CFATS) regulation and the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014 (CFATS Act of 2014) outline how the Department of Homeland Security’s (DHS) Infrastructure Security Compliance Division (ISCD) is to administer the CFATS program. Specifically, any facility that possesses any of the 322 chemicals of interest (COI) in quantities that meet or exceed the screening threshold quantities established by DHS for those COI are required to use ISCD’s Chemical Security Assessment Tool (CSAT)—a web-based application through which owners and operators of facilities with COI are to provide information about the facility—to complete a Top-Screen. The Top-Screen is the initial screening tool whereby a chemical facility in possession of a COI at the requisite thresholds is to provide ISCD data, including the name and location of the facility and the COI and their quantities at the site. ISCD’s risk assessment approach, which relies on data from the Top- Screen, among other sources, is based on three security issues: (1) release (toxic, flammable, and explosive) chemicals with the potential for impacts within and beyond a facility; (2) theft or diversion; and (3) sabotage, depending on the type of risk associated with the COI. Release: For the release threat, ISCD’s approach assumes that a terrorist will release the COI at the facility and then estimates the risk to the facility and surrounding population. Facilities with toxic release chemicals are to calculate and report in their Top-Screen submission the Distance of Concern—which represents the radius of an area in which exposure to a toxic chemical cloud from a release event could cause serious injury or fatalities from short- term exposure. ISCD uses the Distance of Concern to estimate the number of fatalities from an intentional toxic release and to categorize the risk posed by this facility. The Top-Screen directs respondents to use an online tool called RMP*Comp to calculate the Distance of Concern. RMP*Comp takes inputs such as the quantity of chemical that could be released and the surrounding terrain type to determine the Distance of Concern. Theft or diversion: For theft or diversion, the approach assumes that a terrorist will steal or have the COI diverted to him or herself and then estimates the risk of a terrorist attack using the COI to cause the most harm at an unspecified off-site location. Sabotage: For sabotage, the approach assumes that a terrorist will cause water to be mixed with a COI that is shipped from the facility, creating a toxic release at an unspecified location, and then estimates the risk to a medium-sized U.S. city. If, according to ISCD’s automated assessment of information provided via the Top-Screen, the facility is preliminarily categorized to be high-risk it becomes a “covered chemical facility,” and ISCD is to notify the facility of its preliminary placement in one of four risk-based tiers—tier 1, 2, 3, or 4. If ISCD does not categorize the chemical facility as high-risk, ISCD does not assign the facility to one of these four risk-based tiers and the facility is not subject to additional requirements under the CFATS regulation. Facilities that ISCD preliminarily categorizes to be high-risk—covered chemical facilities—are required to then complete the CSAT security vulnerability assessment, which includes the identification of potential critical assets at the facility, and a related vulnerability analysis. ISCD is to review the security vulnerability assessment to confirm and notify the facility as to whether the facility remains categorized as high-risk and, if so, about its final placement in one of the four tiers. Once a covered chemical facility is assigned a final tier, the facility may use CSAT to submit a site security plan (SSP) or submit an Alternative Security Program in lieu of the CSAT SSP. The security plan is to describe the existing and planned security measures to be implemented to address the vulnerabilities identified in the security vulnerability assessment, and identify and describe how existing and planned security measures selected by the facility are to address the applicable risk-based performance standards. To meet risk-based performance standards, covered facilities may choose the security programs or processes they deem appropriate to address the performance standards so long as ISCD determines that the facilities achieve the requisite level of performance on each of the applicable areas in their existing and agreed-upon planned measures. To determine whether facilities achieve the requisite level of performance for each of the applicable areas, ISCD is to conduct a preliminary review of the facility’s security plan to determine whether it meets the risk-based regulatory requirements. If these requirements appear to be satisfied, ISCD is to issue a letter of authorization for the plan, and conduct an authorization inspection of the facility to determine whether to approve the plan. Upon inspection of the facility, if ISCD determines that the plan satisfies the CFATS requirements, it will issue a letter of approval to the facility, which is to then implement the approved SSP. If ISCD determines that the plan does not satisfy CFATS requirements, ISCD then notifies the facility of any deficiencies and the facility must submit a revised plan for correcting them. Following ISCD’s approval of a facility’s SSP, in order to assess compliance with CFATS requirements as addressed through the approved SSP, ISCD conducts a compliance inspection (CI) of the covered facilities. CIs are to follow specific standard operating procedures that focus on verifying existing measures and the implementation and effectiveness of planned measures, including dates implemented, as well as verifying and reviewing any significant changes in the facility’s security posture. If through a compliance inspection it is determined a facility has not fully implemented security measures as outlined in its approved site security plan, ISCD is to provide the facility with written notification that clearly identifies the deficiencies in the SSP and will work with the facility toward achieving full compliance or, if warranted, take enforcement action. For example, the CFATS regulation provides that an order compelling a facility to take appropriate action may be issued if the facility was found to be in violation of any part of the regulation. If a facility were to violate this initial order, an order assessing a civil penalty of up to $25,000 per day or to cease operations, or both, may be issued. According to ISCD guidance, inspectors conducting a CI are to document in a CI report any necessary enforcement actions that may result from the inspection, including, among others, security measures not implemented in accordance with the SSP. ISCD guidance further provides that inspectors are not to recommend enforcement actions where issues identified during a CI are quickly remedied on-site; however, inspectors are to document their finding in the CI report. Inspection teams are to submit their CI report to ISCD management for review and approval within 25 business days from the inspection completion. ISCD management is to then determine whether a facility is in compliance with their approved SSP or whether to take enforcement actions. Figure 3 illustrates the CFATS regulatory process. In February 2009, the Department of Homeland Security’s (DHS) Infrastructure Security Compliance Division (ISCD) began receiving calls related to Chemical Facility Anti-Terrorism Standards (CFATS) via a telephone tip line that ISCD established. ISCD received 345 calls via the telephone tip line from February 2009 to June 15, 2015, the day before ISCD implemented its whistleblower process for addressing CFATS reports in response to the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014 (CFATS Act of 2014). DHS officials stated that there was no requirement for DHS to address CFATS whistleblower reports prior to the act. Starting on June 16, 2015, ISCD implemented a whistleblower process and procedures for addressing CFATS reports, including those received via its telephone tip line, and began to collect and track information for each report in an electronic spreadsheet. Of the 345 calls that ISCD received before implementing the interim process for addressing whistleblower reports, we identified 46 calls (13 percent) that may have involved potential CFATS violations. ISCD officials stated that, at the time they received and vetted the calls, they determined that none of the 345 calls involved CFATS violations. We were not able to reconcile the differences between our determinations and ISCD’s determinations because ISCD officials said they did not consistently document their reviews of the calls, any actions taken, or decisions. Also, our analysis was limited to the transcriptions of each tip line call and did not include any additional documentation. Therefore, our analysis is not intended to assess ISCD’s performance in addressing these reports, but to provide perspective on the types of calls that ISCD received prior to implementing the interim process for addressing reports of potential CFATS violations. Table 3 shows our analysis of the 345 calls that ISCD received via its telephone tip line from February 2009 to June 15, 2015. Table 4 shows the 46 calls that we determined may have involved potential CFATS violations during fiscal years 2009 to 2015 by type of call, based on the information contained in the calls. To provide further insight into the types of calls that ISCD received via the telephone tip line from February 2009 to June 2015, table 5 describes six examples of the calls—three that we determined were not related to CFATS and three that we determined may have involved potential CFATS violations, based on the information contained in the calls. The Department of Homeland Security’s (DHS) Infrastructure Security Compliance Division (ISCD) developed a process and procedures to address reports of potential violations of Chemical Facility Anti-Terrorism Standards (CFATS). The process and procedures were implemented on June 16, 2015. Table 6 describes ISCD’s efforts to develop and implement the process and procedures for the provisions related to a whistleblower procedure in the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014 (CFATS Act of 2014). In addition to the contact named above, Ben Atwater, Assistant Director, and Joseph E. Dewechter, Analyst-in-Charge, managed this audit engagement. Michele Fejfar, Eric Hauswirth, Tracey King, Natalie Maddox, and Tovah Rom made significant contributions to this report.

Summary: The CFATS program is intended to ensure the security of the nation's chemical infrastructure by assessing risks and requiring the implementation of measures to protect high-risk chemical facilities. The CFATS Act of 2014 required DHS to establish a whistleblower process. Employees and contractors at hundreds of thousands of U.S. facilities with hazardous chemicals can play an important role in helping to ensure CFATS compliance by submitting a whistleblower report when they suspect noncompliance. Whistleblowers who disclose wrongdoing at chemical facilities can save lives and help improve public safety and health. The CFATS Act of 2014 also requires GAO to review the CFATS whistleblower process. This report addresses (1) the number and types of CFATS whistleblower reports DHS received, and any actions DHS took as a result, and (2) the extent to which DHS has implemented and followed a process to address the whistleblower reports, including reports of retaliation against whistleblowers. GAO reviewed laws, regulations, and CFATS program documents; analyzed whistleblower reports DHS received from June 16, 2015 to April 19, 2016; and interviewed officials responsible for vetting the reports and deciding how to address them. Of the 105 reports that the Department of Homeland Security (DHS) received under its interim process for whistleblowers from June 16, 2015 (the date DHS was mandated to begin collecting reports by), to April 19, 2016, DHS closed 97 because they did not pertain to Chemical Facility Anti-Terrorism Standards (CFATS) regulations, and referred 70 of the 97 to other federal agencies with legal authority relevant to the reports. DHS determined that 8 of the 105 reports involved potential CFATS violations, and after further review, that 1 report involved an actual CFATS violation. As a result of this report, DHS required the chemical facility to register with DHS as a CFATS-regulated facility. Total Reports Received by DHS and Disposition for Reports, June 16, 2015 to April 19, 2016 In June 2015, DHS implemented an interim process to respond to whistleblower reports involving CFATS and has followed its process since then; however, DHS does not have a documented process and procedures to investigate whistleblower retaliation reports. The Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014 (CFATS Act of 2014) prohibits retaliation against whistleblowers. According to DHS, the department has not received a report of whistleblower retaliation that it substantiated since implementing the interim process and any future retaliation reports would be addressed on a case-by-case basis. However, without a documented process and procedures for investigating whistleblower retaliation reports, DHS may not be able to effectively and efficiently investigate any future retaliation reports. In addition, DHS maintains a telephone tip line and a website with an e-mail address to receive CFATS whistleblower reports. However, the tip line greeting provides no guidance and the website provides limited guidance about the type of information that would be most useful to DHS for addressing the reports. GAO's analysis of 105 reports received by DHS from June 16, 2015, to April 19, 2016, identified challenges that DHS experienced in vetting reports due to insufficient information, such as the name or location of the chemical facility. Additional guidance explaining the detailed information that DHS needs to review reports could help reduce the amount of follow-up time to obtain this information. GAO recommends that DHS develop a documented process and procedures to address whistleblower retaliation reports, and provide additional guidance on the DHS whistleblower website and telephone tip line. DHS agreed with GAO's recommendations.