Select agent regulations do not mandate that specific perimeter security controls be present at BSL-4 labs, resulting in a significant difference in perimeter security between the nation’s five labs. According to the regulations, each lab must implement a security plan that is sufficient to safeguard select agents against unauthorized access, theft, loss, or release. However, there are no specific perimeter security controls that must be in place at every BSL-4 lab. Although BSL-4 labs may have different levels of inherent risk, we determined that these 15 controls (discussed in more detail in app. I) represent a baseline for strong perimeter security. While three labs had all or nearly all of the key security controls we assessed, our September 2008 report demonstrated that two labs (Labs C and E) had a significant lack of these controls. See table 1 below. Lab C: Lab C had in place only 3 of the 15 key security controls we assessed. The lab was in an urban environment and publicly accessible, with only limited perimeter barriers. During our assessment, we saw a pedestrian access the building housing the lab through the unguarded loading dock entrance. In addition to lacking any perimeter barriers to prevent unauthorized individuals from approaching the lab, Lab C also lacked an active integrated security system. By not having a command and control center or an integrated security system with real-time camera monitoring, the possibility that security officers could detect an intruder entering the perimeter and respond to such an intrusion is greatly reduced. Lab E: Lab E was one of the weakest labs we assessed, with 4 out of the 15 key controls in place. It had only limited camera coverage of the outer perimeter of the facility and the only vehicular barrier consisted of an arm gate that swung across the road. Although the guard houses controlling access to the facility were manned, they appeared antiquated and thus did not portray a strong, professional security infrastructure. The security force charged with protecting the lab was unarmed. Of all the BSL-4 labs we assessed, this was the only lab with an exterior window that could provide direct access to the lab. In lieu of a command and control center, Lab E contracts with an outside company to monitor its alarm in an off- site facility. This potentially impedes response time by emergency responders with an unnecessary layer that would not exist with a command and control center. Since the contracted company is not physically present at the facility, it is not able to ascertain the nature of alarm activation. Furthermore, there is no interfaced security system between alarms and cameras and a lack of real-time monitoring of cameras. Although the presence of the controls we assessed does not automatically ensure a secure perimeter, having most of these controls in place and operating effectively reduces the likelihood of intrusion. As such, we recommended in the September 2008 report that the Director of CDC take action to implement specific perimeter controls for all BSL-4 labs to provide assurance that each lab has a strong perimeter security system in place. As part of this recommendation, we stated that CDC should work with USDA to coordinate its efforts, given that both agencies have the authority to regulate select agents. In its response to the September 2008 report, HHS agreed that perimeter security is an important deterrent against theft of select agents. HHS indicated that the difference in perimeter security at the five labs was the result of risk-based planning; however, they did not comment on the specific vulnerabilities we identified and whether these should be addressed. In regard to requiring specific perimeter controls for all BSL-4 labs, HHS stated that it would perform further study and outreach to determine whether additional federal regulations are needed. Significant perimeter security differences continue to exist among the nation’s five BSL-4 labs operational at the time of our most recent assessment. In our July 2009 report, we stated that CDC has taken limited steps to address our recommendation that it should take action to implement specific perimeter security controls for all BSL-4 labs. CDC stated that the following actions have been taken as of May 2009: In late 2007, CDC, along with other federal agencies, established a U.S. Government Trans-Federal Task Force on Optimizing Biosafety and Biocontainment Oversight. The task force was formed to assess the current framework for local and federal oversight of high-containment laboratory research activities and facilities, including the identification and assessment of pertinent laws, regulations, policies, guidelines, and examination of the current state of biosafety oversight systems. The task force held a public consultation meeting in December 2008. According to CDC, the task force will communicate specific recommendations about the nation’s lab safety and security issues to the Secretaries of both HHS and USDA. CDC and USDA hosted a workshop series in Greenbelt, Maryland, in December 2008 for all of their registered entities and partners. CDC stated that it included several safety and security topics, including discussion of physical security and operational security. In January 2009, in response to Executive Order 13486, a federal working group (WG) was convened to review current laws, regulations, and guidelines in place to prevent theft, misuse, or diversion to unlawful activity of select agents and toxins. The WG is chaired by HHS and the Department of Defense (DOD) and includes representatives from several federal agencies and includes a subgroup that is focused on physical and facility security of biolabs. The WG is expected to issue its final report to the President. Although CDC has taken some modest steps for studying how to improve perimeter security controls for all BSL-4 labs, CDC has not established a detailed plan to implement our recommendation. Without a detailed plan from CDC on what corrective actions are planned, it is impossible to monitor CDC’s progress in implementing our recommendation to improve perimeter security controls for all BSL-4 labs. The ability to monitor progress openly and transparently is especially important because a sixth BSL-4 lab recently became operational, as mentioned above, and CDC expects more BSL-4 labs to be operational in the future. Although CDC has taken limited action to address our findings from our September 2008 report, the two deficient BSL-4 labs have made progress on their own. In our July 2009 report, we stated that one BSL-4 lab made a significant number of improvements to increase perimeter security, thus reducing the likelihood of intrusion. The second one made three changes and formed a committee to consider and prioritize other changes. We confirmed the following improvements at Lab C: Visitors are screened by security guards and issued visitor badges. A command and control center was established. Camera coverage includes all exterior lab entrances. Closed-circuit television (CCTV) is monitored by the command and control center. The cameras currently cover the exterior of the building. Guards can control the cameras by panning, zooming, or tilting. One visible guard is present at the main entrance to the lab, but the guard is not armed. A guard mans the entrance 24-hours a day, 7 days a week. Although the guard is unarmed, this improvement does partially address the requirement for guard presence at lab public entrances. Lab officials described installing armed guards as cost prohibitive. While the loading dock is still located inside the footprint of the main building, Lab C improved its loading dock security by building a loading dock vehicle gate. Moreover, a pedestrian gate with a sign forbidding entry was built to prevent pedestrians from entering the building through the loading dock; pedestrians were previously allowed to enter the building through the loading dock as a way of taking a short-cut into the building. These new gates prevent individuals from walking into the building, or vehicles driving up to the building, unchallenged. Lab officials said additional enhancements would be completed by fall 2009. These include an active intrusion detection system that is integrated with CCTV and the addition of 14 new interior cameras with pan, tilt, and zoom capabilities. The new cameras will enhance the interior perimeter security of the lab. The command and control center also will have access to and control of these new cameras. After these improvements are finished, the lab will have 8 of the 15 controls we tested in place plus 2 others that were partially addressed. We verified three improvements were made at Lab E—heavy concrete planters were added as a vehicle barricade along the roadside adjacent to the building; the window was frosted to block sight lines into the lab from nearby rooftops; and a vehicle barricade is being constructed to block unauthorized access to the parking lot adjacent to the lab, thereby increasing the blast stand-off area. The lab also formed a committee to consider additional perimeter security measures such as widening buffer zones and increasing lighting at the perimeter fence. In all, the lab now has 6 of the 15 controls we assessed in place. Although lab officials made three improvements and are considering others, the lab’s head of research operations at the facility objected to the findings of our September 2008 report and has challenged the 15 controls we deemed critical to strong perimeter security. He said that the officials from the lab were not afforded an opportunity to respond to the report and correct “inaccuracies.” Specifically, he made the following comments on our previous findings: He questioned the basis for our selection of the specific 15 controls we identified as critical to perimeter security, and noted that CDC also expressed similar concerns in its comments on our September 2008 report. The lab windows do not provide direct access to the lab. He maintained that a number of features prohibited entry by these windows: the lowermost edge of the windows is more than 7 feet 8 inches above ground level, the windows are certified bulletproof glass and are equipped with inside bars, and breaching the integrity of the outer bulletproof glass triggers alarms for the local guard force. Furthermore, he said that having such a window was deemed programmatically important when the laboratory was designed in order to provide light- dark orientation for laboratory workers. Finally, he represented that a group of nationally recognized security experts has opined that the windows are not a security threat, but did not provide evidence of these experts’ assessment.