DHS’s NPPD leads the national effort to protect and enhance the resilience of the nation’s physical and cyber infrastructure. The directorate includes the Office of Infrastructure Protection, which leads the coordinated national effort to reduce risk to U.S. critical infrastructure posed by acts of terrorism. Within the Office of Infrastructure Protection, ISCD leads the nation’s effort to secure high-risk chemical facilities and prevent the use of certain chemicals in a terrorist act on the homeland, as well as implementing CFATS and managing the CFATS program, including its whistleblower process and procedures. The CFATS program is intended to ensure the security of the nation’s chemical infrastructure by identifying, assessing the risk posed by, and requiring the implementation of measures to protect high-risk chemical facilities. Section 550 of the DHS Appropriations Act, 2007, required DHS to issue regulations establishing risk-based performance standards for chemical facilities that, as determined by DHS, present high levels of risk; the act also required vulnerability assessments and development and implementation of site security plans for such facilities. DHS published the CFATS interim final rule in April 2007 and appendix A to the rule, published in November 2007, lists 322 COI and the screening threshold quantities for each. According to DHS, subject to certain statutory exclusions, all facilities that manufacture COI as well as facilities that store or use such chemicals as part of their daily operations may be subject to CFATS. However, only chemical facilities determined to possess a requisite quantity of COI (that is, the screening threshold quantity) and subsequently determined to present high levels of security risk—that is, covered facilities—are subject to the more substantive requirements of the CFATS regulation. The CFATS Act of 2014 amended the Homeland Security Act of 2002 by adding the Chemical Facility Anti-Terrorism Standards as Title XXI and, in effect, authorizing the program for an additional 4 years. Among other things, the act expressly repeals DHS’s authority to implement the program under section 550 of the DHS Appropriations Act, 2007, but also expressly provides that the CFATS regulation promulgated under that authority shall remain in effect unless otherwise amended, consolidated, or repealed. Consequently, while the act imposes new and additional responsibilities on DHS to implement the CFATS program, including a whistleblower procedure, the program continues to be implemented by ISCD under the existing regulatory framework. For more information about the CFATS regulation and process, see appendix II. According to the CFATS Act of 2014, among other things, DHS is to implement the following six provisions related to a whistleblower procedure: 1. not later than 180 days after the date of enactment of the CFATS Act of 2014, establish and provide information to the public regarding a procedure under which any employee or contractor of a chemical facility of interest may submit a report of a CFATS violation, 2. keep confidential the identity of an employee or contractor at a chemical facility of interest, who submits a report of a potential CFATS violation under the established whistleblower procedure, 3. promptly respond to an employee or contractor at a chemical facility of interest, who provides contact information, to acknowledge receipt of the report, 4. review and consider the information provided in any report submitted, and take action, as appropriate, to address any substantiated CFATS violation, 5. follow certain procedural requirements if the Secretary determines that a violation has occurred and decides to institute a civil enforcement or issue an emergency order against a chemical facility, as appropriate under the law, and 6. work in partnership with industry associations and labor organizations to make publicly available, physically and online, the rights that an individual who provides DHS with whistleblower information about a covered chemical facility, would have under federal law. In addition, the CFATS Act of 2014 provides that an owner or operator of a chemical facility of interest may not discharge or otherwise discriminate against an employee or contractor because of submitting a report to DHS of a CFATS violation. According to DHS officials, to meet the definition of a whistleblower report under the CFATS Act of 2014, the report must be from an employee or contractor at a chemical facility of interest and involve a potential CFATS violation. A CFATS violation is when officials at a chemical facility of interest violate a provision of the CFATS Act of 2014 or CFATS regulations, such as knowingly submitting false information to DHS or failing to maintain appropriate records. From June 16, 2015 (when ISCD implemented its whistleblower process) to April 19, 2016, ISCD received 105 reports from individuals—90 via the ISCD telephone tip line, 14 via e-mail, and 1 from ISCD’s CFATS help desk. ISCD officials determined that 8 of the 105 reports were potential CFATS violations and, after further review, that 1 of the 8 reports involved a CFATS violation. For the report that ISCD determined was a CFATS violation, ISCD took action against the chemical facility by requiring it to register with ISCD pursuant to requirements of the CFATS program. ISCD officials determined that 97 of the 105 reports were not potential CFATS violations and closed the reports because they did not pertain to requirements under the CFATS program. The most common types of reports that ISCD officials determined were not potential CFATS violations involved allegations of suspicious or illegal activity not related to CFATS. Additionally, the majority of the reports were submitted by concerned individuals, not employees or contractors at chemical facilities; therefore, the individuals were not whistleblowers as defined by DHS. However, ISCD officials also review and address reports from individuals who are outside of the statutory definition. ISCD officials referred 70 of the 97 reports (72 percent) to other federal agencies or departments consistent with ISCD’s interim process for addressing reports, which states that certain reports are to be referred to other agencies or departments. For example, reports related to terrorism are to be referred to the Federal Bureau of Investigation (FBI) Washington Field Office, and reports related to environmental or community safety are to be referred to the EPA. Of the 70 reports that ISCD referred to other federal agencies or departments, 63 reports (90 percent) related to terrorism and other allegations of criminal activity were referred to the FBI. Figure 1 illustrates the number and percentage of reports that ISCD received from June 16, 2015 through April 19, 2016, and the disposition for the 97 reports that ISCD officials determined did not involve potential CFATS violations. In addition to the 105 reports that ISCD received from June 16, 2015 to April 19, 2016, ISCD received 345 calls from February 2009—when ISCD created its telephone tip line for potential CFATS violations—to June 15, 2015 (the day before ISCD implemented its interim process for addressing CFATS whistleblower reports). See appendix III for our analysis of the 345 calls. Of the 105 reports, ISCD further reviewed 8 reports (8 percent) that officials determined to involve potential CFATS violations. ISCD officials determined that, for one of the eight reports, the chemical facility met threshold requirements for COI and, therefore, the chemical facility had violated CFATS for failure to submit required CFATS documentation to ISCD. Specifically, a concerned individual, who was not an employee or contractor of a chemical facility, submitted a report about a commercial propane facility near a residential area. The individual cited concerns about the facility’s lack of security and expressed fear of a catastrophic event if the facility was not in compliance with DHS’s security regulations. ISCD followed-up with the individual to obtain more information and contacted the facility to obtain information about the quantity of COI at the facility. ISCD determined that a CFATS violation had occurred because the facility met the threshold reporting requirements, but had not registered with ISCD. In addition, ISCD determined that the company had seven other facilities that should have registered with ISCD. ISCD closed the report without pursuing civil enforcement action because the facility submitted required CFATS documentation after ISCD directed the facility to do so. ISCD determined that six of the eight reports were not CFATS violations because the chemical facilities or issues reported were not subject to CFATS regulations. For example, for four reports, ISCD found that the facilities did not have sufficient quantities of COI to meet threshold regulatory requirements. The remaining report is still open because ISCD officials have not completed their investigation. Table 1 describes the eight reports that ISCD further reviewed to determine whether they were CFATS violations. In response to the CFATS Act of 2014, ISCD developed a documented, interim process to address reports of potential CFATS violations, and implemented the process on June 16, 2015. Figure 2 illustrates the process and its key procedures. Our analyses of ISCD’s efforts related to implementing a whistleblower procedure show that, since June 16, 2015, ISCD has had an interim process and procedures for all six related provisions for DHS in the CFATS Act of 2014. Our analyses also show that ISCD has implemented its interim process and procedures for five of the six provisions. ISCD officials stated that there has not been a need to implement the remaining provision—to follow certain procedural requirements if the Secretary determines that a violation has occurred and decides to institute a civil enforcement or issue an emergency order. Specifically, from June 16, 2015 to April 19, 2016, there was one whistleblower report that they substantiated, but it did not result in a civil enforcement or emergency order because the chemical facility took the action that ISCD required. Table 2 lists the results of our assessment of ISCD’s efforts since June 16, 2015 to develop and implement a whistleblower process and procedures for the six related provisions for DHS in the CFATS Act of 2014. For a more detailed description of ISCD’s efforts to develop and implement a whistleblower process and procedures, see appendix IV.