Experts agree that chemical facilities are among the most attractive targets for terrorists intent on causing massive damage. Despite the risk these facilities pose, no one has yet comprehensively assessed security at the nation’s chemical facilities. EPA regulates about 15,000 facilities under the 1990 amendments to the Clean Air Act because they produce, use, or store more than certain threshold amounts of specific chemicals that would pose the greatest risk to human health and the environment if they were accidentally released into the air. These facilities must take a number of steps, including preparing a risk management plan (RMP), to prevent and prepare for an accidental release and, therefore, are referred to as RMP facilities. These facilities fall within a variety of industries and produce, use, or store a variety of products, including basic chemicals; specialty chemicals, such as solvents; life science chemicals, such as pharmaceuticals and pesticides; and consumer products, such as cosmetics. Some of these facilities are part of critical infrastructure sectors other than the chemical sector. For example, about 2,000 of these facilities are community water systems that are part of the water infrastructure sector. In addition, other facilities that house hazardous chemicals that are listed under the RMP regulations are not subject to RMP requirements because the quantities stored or used are below threshold amounts. Through the RMP program, EPA has gained extensive expertise with chemical facilities and processes that could be useful in helping DHS assess security issues. Federal requirements currently address security at some U.S. chemical facilities. For example, a small number of chemical facilities must comply with the Maritime Transportation Security Act of 2002 and its implementing regulations, which require maritime facility owners and operators to conduct assessments, develop security plans, and implement security measures. In addition, certain community water systems—while not specifically considered chemical facilities but which use and store large volumes of chemicals—are required by the Public Health Security and Bioterrorism Preparedness and Response Act of 2002 to conduct and submit a vulnerability assessment to EPA and prepare an emergency response plan that incorporates the results of the assessment. According to EPA, 1,928 drinking water facilities that are also subject to EPA’s RMP program must comply with this act. Some states and localities have also created security requirements at chemical facilities. In addition, the federal government imposes safety and emergency response requirements on chemical facilities that may incidentally reduce the likelihood and consequences of terrorist attacks. For example, Section 112(r) of the Clean Air Act includes a general duty clause directing owners and operators of facilities to identify hazards, design and maintain a safe facility to prevent releases, and minimize the consequences of any accidental releases that occur. Under Section 112(r), RMP facilities must also implement a program to prevent accidental releases that includes safety precautions and maintenance, and monitoring and training measures, and they must have an emergency response plan. The Department of Labor’s Occupational Safety and Health Administration’s process safety management standard also requires facilities to conduct analyses of their chemical processes which must address hazards of the process, engineering and administrative controls applicable to the hazards, facilities siting, and evaluation of the possible health and safety effects of failures of controls on employees. DHS is developing a plan for protecting the chemical sector that will establish a framework for reducing the overall vulnerability of the sector in partnership with the industry and state and local authorities. At the time of our review, DHS did not provide a specific date for completion of the Chemical Sector-Specific Plan. DHS completed a draft of the plan in July 2004 and has been working to revise it to accommodate changes to DHS’s risk management strategy and comments from stakeholders. DHS officials told us that the final plan—which they now expect to complete and release in the fall of 2006—will reflect the basic principles and content described in the draft plan. On the basis of our review of the draft plan and discussions with DHS officials, the final plan will, among other things, (1) present background information on the sector; (2) describe the process DHS will use to develop an inventory of chemical sector assets; (3) describe DHS’s efforts to identify and assess chemical facilities’ vulnerabilities and plans to prioritize these efforts on the basis of the vulnerability assessments; (4) outline the protective programs that will be created to prevent, deter, mitigate, and recover from attacks on chemical facilities, and describe how DHS will work with private sector and government entities to implement these programs; (5) explain the performance metrics DHS will use to measure the effectiveness of DHS and industry security efforts; and (6) outline the department’s challenges in coordinating the efforts of the chemical sector. DHS has also initiated actions to identify the chemical sector’s critical assets, prioritize facilities, develop and implement protective programs, exchange information with the private sector, and coordinate efforts with EPA and other federal agencies. DHS is focusing its efforts for the chemical sector by identifying high-priority facilities. As a starting point, DHS has adapted EPA’s RMP database of facilities with more than threshold amounts of certain chemicals to develop an interim inventory of 3,400 chemical facilities that pose the greatest hazard to human life and health in the event of a terrorist attack. These are facilities where a worst- case scenario release potentially could affect over 1,000 people. According to DHS, 272 of these facilities could potentially affect more than 50,000 people. DHS is also developing a new risk assessment methodology to compare and prioritize all critical infrastructure assets according to their level of threat, their vulnerability to attack, and the consequences of an attack on the facility. According to DHS, Risk Analysis Management for Critical Asset Protection (RAMCAP) will provide a common methodology, terminology, and framework for homeland security risk analysis and decision making that is intended to allow consistent risk management across all sectors. The RAMCAP process entails chemical facility owners/operators voluntarily completing a screening tool to identify the consequences of an attack. On the basis of the results of the screening tool, DHS will identify facilities of highest concern and ask them to voluntarily complete a security vulnerability assessment. Finally, DHS has implemented a number of programs to assist the private sector and local communities in reducing vulnerabilities. For example, DHS works with local law enforcement officials and facility owners through the Buffer Zone Protection Program to improve the security of the area surrounding a facility. To assess and identify vulnerabilities at chemical facilities, DHS deploys teams of experts from both government and industry to conduct a site assistance visit. DHS had conducted 38 site assistance visits at chemical facilities as of June 15, 2005, and planned to conduct additional visits in fiscal year 2006 on the basis of need. DHS has also installed cameras at some high-consequence facilities, providing local law enforcement authorities with the ability to conduct remote surveillance and allowing state homeland security offices and DHS to monitor the facilities. In addition, DHS distributes threat information to the industry through various means and coordinates sector activities with the Chemical Sector Coordinating Council, an industry-led working group formed voluntarily by trade associations that acts as a liaison for the chemical sector. DHS also coordinates with EPA and other federal agencies through a government coordinating council. EPA officials believe that the agency could further assist DHS by providing analytical support in identifying high-risk facilities that should be targeted in DHS’ chemical sector efforts, among other activities. With few federal security requirements, industry associations have been active in promoting security among member companies. Some industry associations, including the American Chemistry Council (ACC), the Synthetic Organic Chemical Manufacturers Association, and the National Association of Chemical Distributors, require member companies to assess their facilities’ vulnerabilities and make security enhancements, requiring as a condition of membership that they conduct security activities and verify that these actions have been taken. ACC, representing 135 chemical manufacturing companies with approximately 2,000 facilities, has led the industry’s efforts to improve security at their facilities. ACC requires its members to adhere to a set of security management principles that include performing physical security vulnerability assessments using an approved methodology, developing plans to mitigate vulnerabilities, taking actions to implement the plans, and having an independent party such as insurance representatives or local law enforcement officials verify that the facilities implemented the identified physical security enhancements. These reviewers do not verify that a vulnerability assessment was conducted appropriately or that actions taken by a facility adequately address security risks. However, ACC requires member companies to periodically conduct independent third-party audits that include an assessment of their security programs and processes and their implementation of corrective actions. In addition, ACC members must take steps to secure cyber assets, such as computer systems that control chemical facility operations, and the distribution chain from suppliers to customers, including transportation. Other industry associations have encouraged their members to address security by a variety of means. Most of the 16 associations we spoke to have developed security guidelines and best practices. For example, the International Institute of Ammonia Refrigeration, representing facilities such as food storage warehouses, developed site security guidelines tailored to ammonia refrigeration facilities and provides information about security resources to members. Several industry associations have also developed vulnerability assessment methodologies to assist their member companies in evaluating security needs. For example, the National Petrochemical and Refiners Association, in partnership with the American Petroleum Institute, developed a vulnerability assessment methodology tailored to refiners and petrochemical facilities. Despite industry associations’ efforts to encourage or require members to voluntarily address security, the extent of participation in the industry’s voluntary initiatives is unclear. Chemical industry officials told us they face a number of challenges in preparing facilities against a terrorist attack. Most of the chemical associations we contacted stated that the cost of security improvements is a challenge for some chemical companies. For example, ACC reports that its members have spent an estimated $2 billion on security improvements since September 11, 2001. Representatives of the American Forest & Paper Association and the National Paint and Coatings Association told us that small companies, in particular, may struggle with the cost of security improvements or the cost of complying with any potential government security programs because they may lack the resources larger companies have to devote to security.