Homeland Security
Department of Justice's Response to Its Congressional Mandate to Assess and Report on Chemical Industry Vulnerabilities Gao ID: GAO-03-24R October 10, 2002Congress passed the Chemical Safety Information, Site Security and Fuels Regulatory Relief Act after a number of testimonies expressing concerns about the vulnerability of chemical facilities to criminal and terrorist attacks. According to the Attorney General's interim report, chemical facilities visited generally had safety and emergency response measures that could mitigate the consequences of a terrorist attack. The report further stated that the level of security at chemical facilities is roughly equivalent to standard security practices found in most industries. The interim report also contains nine preliminary findings that cumulatively address the other required reporting elements--the vulnerability of facilities to criminal and terrorist activity, current industry site security practices, and the security of chemicals being transported. These findings address the extent to which 11 facilities conducted facility security assessments, had the capability to respond to armed attacks, conducted emergency response exercises, conducted routine pre-employment background investigations, had secure process control systems, had secure chemical transportation containers, had adequate security measures over transportation of hazardous chemicals, received meaningful threat information, and had effective facility security systems.
GAO-03-24R, Homeland Security: Department of Justice's Response to Its Congressional Mandate to Assess and Report on Chemical Industry Vulnerabilities
This is the accessible text file for GAO report number GAO-03-24R
entitled 'Homeland Security: Department of Justice's Response to Its
Congressional Mandate to Assess and Report on Chemical Industry
Vulnerabilities' which was released on October 10, 2002.
This text file was formatted by the U.S. General Accounting Office
(GAO) to be accessible to users with visual impairments, as part of a
longer term project to improve GAO products‘ accessibility. Every
attempt has been made to maintain the structural and data integrity of
the original printed product. Accessibility features, such as text
descriptions of tables, consecutively numbered footnotes placed at the
end of the file, and the text of agency comment letters, are provided
but may not exactly duplicate the presentation or format of the printed
version. The portable document format (PDF) file is an exact electronic
replica of the printed version. We welcome your feedback. Please E-mail
your comments regarding the contents or accessibility features of this
document to Webmaster@gao.gov.
October 10, 2002:
The Honorable John D. Dingell:
Ranking Minority Member:
Committee on Energy and Commerce:
House of Representatives:
The Honorable Frank Pallone, Jr.
Ranking Minority Member:
Subcommittee on Environment and Hazardous Materials:
Committee on Energy and Commerce:
House of Representatives:
Subject: Homeland Security: Department of Justice‘s Response to Its
Congressional Mandate to Assess and Report on Chemical Industry
Vulnerabilities:
On August 5, 1999, after a number of testimonies expressing concerns
about the vulnerability of chemical facilities[Footnote 1] to criminal
and terrorist attacks, Congress passed the Chemical Safety Information,
Site Security and Fuels Regulatory Relief Act (CSISSFRRA),[Footnote 2]
which, among other things, required the Department of Justice to review
the vulnerability of these facilities. The act also required the
Attorney General to prepare two reports--an interim report containing
preliminary findings by August 5, 2000, and a final report by August 5,
2002.
Specifically, Justice was to address the extent to which Clean Air Act
regulations regarding the prevention of accidental releases have
resulted in actions, including the design and maintenance of safe
chemical facilities, that are effective in detecting, preventing, and
minimizing the consequences of regulated substances that may be
released as a result of criminal activity. Furthermore, using available
data to the extent possible and a sample of facilities, and consulting
with appropriate state, local, and federal government agencies,
affected industry, and the public, Justice was to review the
vulnerability of chemical facilities to criminal and terrorist
activity, current industry practices regarding site security, and the
security of transportation of regulated substances. Finally, Justice
was
to include recommendations, if any, for reducing the vulnerability of
these facilities to criminal and terrorist activities. The interim
report
was to include, at a minimum, preliminary findings from this review,
the
methods used to develop the findings, and an explanation of the
activities expected to occur that could cause the findings in the final
report to differ from those in the interim report. The final report was
to discuss the complete results of the review. CSISSFRRA authorized to
be appropriated such sums as necessary to carry out the requirements.
In a separate but related action, the October 2000 Conference
report[Footnote 3] on Justice‘s appropriation act for fiscal year 2001
directed Justice to use $600,000 of the Office of Justice Programs,
Justice Assistance appropriation for its National Institute of Justice
to develop, test, and validate a prototype vulnerability assessment
methodology to assess the security of chemical facilities against
terrorist and criminal acts, consistent with the CSISSFRRA
requirements.[Footnote 4]
As part of our ongoing study of chemical industry security, you asked
us to describe Justice‘s actions to comply with the 1999 congressional
mandate to review and report on the vulnerability of chemical
facilities. This report responds to that request. As agreed, we will
report early next year on other issues concerning the security of
chemical facilities.
Justice Initiated Actions to Study the Vulnerability of the Chemical
Industry but Has Not Fully Met Its Statutory Requirements:
Justice has only partially fulfilled the requirement to review and
report on the vulnerability of chemical facilities to terrorist or
criminal attack. Justice prepared and submitted an interim report to
Congress in May 2002. The interim report was based on observations made
at 11 chemical manufacturing facilities Justice visited in developing a
methodology requested by its appropriations conference committee. The
facilities visited represent only a small portion of the 15,000
chemical facilities subject to the Clean Air Act‘s risk management plan
provisions. While the interim report contains the elements required by
CSISSFRRA, it was submitted nearly 2 years after it was due, and the
results cannot be generalized to the industry as a whole.
Additionally, Justice did not submit its final report to Congress by
August 5, 2002, as required. Justice told us that because of competing
priorities in its budget, it had not yet conducted a more comprehensive
final study. While Justice determined that it did not have adequate
funds to conduct the study of the vulnerability of chemical facilities
to attack, it did not formally request additional funds from Congress
for this purpose in fiscal year 2001 or 2002. Justice has asked for $3
million in its fiscal year 2003 budget request and plans to conduct the
study and issue the final report if it receives these funds. We note
that Justice should have used its existing appropriations for the
study. Generally, when Congress imposes a new requirement on an agency
but does not appropriate funds specifically to implement it, the agency
must use existing appropriations to fund the requirement.[Footnote 5]
Justice‘s Interim Report Was Based on Observations Made While
Developing a Methodology to Assess Chemical Facilities‘ Vulnerability
to Terrorist Attack:
Justice determined that the first step in meeting the CSISSFRRA
requirements was to develop a methodology to assess the security of
chemical facilities. On March 31, 2000, the Justice submitted notice to
the House and Senate Committees on Appropriations that it planned to
transfer $750,000 from the Counterterrorism appropriation to the Office
of Justice Programs appropriation to develop a methodology. According
to Justice, the committees disagreed with the transfer and Justice
elected not to proceed with it.
A conference committee later directed Justice to use $600,000 of the
Office of Justice Programs, Justice Assistance appropriation for the
department‘s National Institute of Justice to develop, test, and
validate a prototype vulnerability assessment methodology to assess the
security of chemical facilities against terrorist and criminal acts,
consistent with the CSISSFRRA requirements.[Footnote 6]
In January 2001, Justice, together with the Department of Energy‘s
Sandia National Laboratory, began developing, testing, and validating
the vulnerability assessment methodology. The methodology provides a
tool to identify risks and mitigate the consequences of terrorist
attacks. In July 2002, Justice made the completed methodology publicly
available to assist chemical companies in identifying and assessing
their threats, risks, and vulnerabilities. In addition, chemical
industry associations are encouraging their members to use this
methodology to evaluate their facilities.
On the basis of observations made during the development of the
methodology, Justice prepared a 12-page interim report to Congress in
response to the CSISSFRRA requirement. Justice determined that the
report contains information that if released would pose a threat to
national security and therefore has not made it publicly
available.[Footnote 7] As required, the interim report (1) provides
preliminary findings, (2) discusses the methods used to develop those
findings, (3) includes Justice‘s recommendations for reducing the
vulnerability of facilities to terrorist activity, and (4) explains
activities expected to occur that could result in differences between
the findings in the interim and final reports. The interim report does
not assess overall security at chemical facilities, but rather, it
provides observations Justice made about security at a few facilities
during the development of the methodology.
Interim Report‘s Preliminary Findings:
The interim report discusses two preliminary findings that address the
extent to which the Clean Air Act‘s accidental release regulations have
resulted in actions that are effective in detecting, preventing, and
minimizing the consequences of releases of regulated substances that
may be caused by criminal and terrorist activity. According to the
report, chemical facilities visited generally had safety and emergency
response measures that could mitigate the consequences of a terrorist
attack.[Footnote 8] The report further stated that the level of
security at chemical facilities is roughly equivalent to standard
security practices found in most industries. However, we could not
determine from our discussions with Justice officials what work was
performed to support this finding, and we are continuing to investigate
this issue as part of our ongoing review.
The interim report also contains nine preliminary findings that
cumulatively address the other required reporting elements--the
vulnerability of facilities to criminal and terrorist activity, current
industry site security practices, and the security of chemicals being
transported. These findings address the extent to which the 11
facilities:
* conducted facility security assessments,
* had the capability to respond to armed attacks,
* conducted emergency response exercises,
* conducted routine pre-employment background investigations,
* had secure process control systems,
* had secure chemical transportation containers,
* had adequate security measures over transportation of hazardous
chemicals,
* received meaningful threat information, and:
* had effective facility security systems.
Concerning transportation, Justice officials told us that their
observations to date were limited to the transportation of chemicals
within a facility and that a broader review of transportation
vulnerabilities outside a facility is needed.
Methods Used to Develop Preliminary Findings:
Justice‘s preliminary findings are based on the work that it and Sandia
did to develop the vulnerability assessment methodology. Consequently,
the scope and limitations of the interim report‘s preliminary findings
are the same as those for the methodology. In developing the
methodology, Justice identified approximately 15,000 U.S. facilities
that produce, dispose of, or in some manner handle or use hazardous
chemicals. Justice focused on chemical facilities that manufactured
chemicals hazardous to human life. These were chemicals that, if
inhaled or touched by individuals, would cause harmful or lethal
results. To develop and test the methodology, Justice and Sandia
personnel met with industry and government officials and visited 11
chemical manufacturing facilities from April 2001 through January 2002.
These facilities were selected in consultation with personnel from the
American Chemistry Council, the chemical manufacturing industry‘s trade
association, who suggested that the security at these facilities was
representative of a broad range of facilities in the industry. These
facilities represented a range of characteristics such as (1) location-
-six urban and five rural sites and (2) the number of employees--three
had more than 1,000 employees, three had fewer than 100 employees, and
the remaining five ranged from 100 to 1,000 employees. Justice and
Sandia focused primarily on physical security at fixed sites--the
security of electronic chemical process control systems and
transportation systems was a secondary focus.
Because the findings in the interim report are based on visits to only
11 facilities, the report states that caution should be exercised in
generalizing the findings to the entire industry. However, the report
also notes that these visits provided the department with the
opportunity to identify potential threats, overall risks, and
vulnerabilities at these chemical facilities. Also, according to
Justice, chemical facilities that store and use chemicals may present
fundamentally different security concerns than chemical facilities that
produce or manufacture chemicals--such as those included in the Justice
study--and that, as such, the preliminary findings and recommendations
may not apply other than to manufacturing facilities. It is important
to note that of the approximately 15,000 facilities covered by the
Clean Air Act, according to an official at the Environmental Protection
Agency, only about 1,500 produce or manufacture chemicals.
Interim Report Recommendations:
The interim report notes that in addition to the use of effective
security systems, other remedial measures should be considered to lower
the probability of a successful terrorist attack. Justice officials
told us that these recommendations apply to the 11 facilities they
visited and may not be applicable to other chemical facilities. While
Justice has not made the recommendations publicly available, officials
said that chemical facilities would be able to identify measures to
potentially lower the probability of a successful terrorist attack when
they conduct their own vulnerability assessments.
Potential Differences Between the Interim and Final Reports:
Justice notes that its report is based primarily on information and
practices developed prior to September 11, 2001, and therefore the
findings in a final report may differ in some respects from those in
the interim report. Furthermore, some chemical manufacturers have
altered their security measures since September 2001, and those changes
may not be fully reflected in the interim report. According to Justice
officials, Sandia visited five facilities prior to, and six after,
September 11, 2001.
Justice Does Not Plan to Conduct the Study and Issue the Final Report
Unless Congress Provides Requested Funding:
According to Justice officials, Justice did not comply with the
CSISSFRRA requirement to issue the final report by August 5, 2002,
because it determined that it did not have adequate funds in its
existing budget and Congress has not provided funds specifically for
this purpose.[Footnote 9] Justice has estimated the study would cost:
$7 million, but did not provide the basis for this estimate. And while
Justice could not identify funds to conduct a study of the security of
the chemical industry, it did not ask Congress for funds for this
purpose in fiscal year 2001 or 2002, or in the supplemental
appropriations for either year. Justice has requested $3 million as
part of its lump sum appropriation for Salaries and Expenses, General
Administration for fiscal year 2003 for ’chemical plant vulnerability
assessments.“[Footnote 10] According to officials, Justice does not
plan to conduct any further work to assess the vulnerability of the
chemical industry, nor does it plan to issue the final report to
Congress unless Congress enacts the lump sum appropriation in the
amount Justice has requested.
Nevertheless, while Justice‘s appropriations acts have not provided the
department an earmark or a specific line item appropriation for this
purpose, Justice does have appropriations legally available for this
purpose. Justice is authorized to use its existing and available lump
sum appropriations for this purpose. Generally, when Congress imposes a
requirement but does not appropriate additional funds to specifically
carry it out, an agency must use an existing appropriation to implement
the requirement--one that is consistent with the purposes of the
particular appropriation being charged for that expense.[Footnote 11]
Justice‘s interim report recognizes that a vulnerability assessment
would help identify and set priorities for security vulnerabilities at
chemical facilities, compare security risks across chemical facilities,
and help companies make the best use of security funding and other
resources to address priority vulnerabilities. Furthermore, according
to the administration‘s July 2002 National Strategy for Homeland
Security, comprehensive vulnerability assessments of critical
infrastructures enable authorities to evaluate the potential effects of
an attack on a given facility or sector and to invest accordingly.
Agency Comments and Our Evaluation:
We provided a draft of this report to the Department of Justice for its
review and comment. Justice agreed with the majority of the
observations contained in the report. However, Justice expressed
concern that we did not place its efforts in the proper context when we
observed that it did not use available funds to address the
comprehensive reporting requirements included in CSISSFRRA. Justice
also explained the notification provisions found in section 605 of its
appropriations acts.
We recognized the initial efforts Justice made to address the reporting
requirements included in CSISSFRRA. As we stated in our report, Justice
has partially addressed the CSISSFRRA mandate by preparing an interim
report. We also reported that Justice notified the House and Senate
Committees on Appropriations that it planned to transfer $750,000 from
its Counterterrorism appropriation to develop a methodology. This
notice explained that this money would fund phase one of its project to
prepare a report required by CSISSFFRA. As Justice explains in its
comments to us, section 605 of its appropriations acts required it to
notify the committees of its proposal to use these funds. As we
reported, the appropriations committees disagreed with this transfer
and Justice elected not to proceed. Later, a conference committee
directed Justice to use $600,000 to develop, test, and validate a
prototype vulnerability assessment methodology.
While Justice proposed to use $750,000 in 2000 for the first step in
meeting the CSISSFRRA requirements, it did not attempt to use funds
from any other appropriations or ask Congress for funds to complete a
study of the security of the chemical industry until fiscal year 2003.
As we stated in the report, we believe that when Congress imposes a new
requirement on an agency but does not appropriate funds specifically to
implement it, the agency must use existing appropriations to fund the
requirement.
The Department of Justice‘s letter to us is contained in enclosure I.
Scope and Methodology:
To describe Justice‘s actions to review the vulnerability of the
chemical industry against criminal and terrorist acts and to fulfill
its statutorily mandated reporting requirements, we reviewed the
requirements of the Chemical Safety Information, Site Security and
Fuels Regulatory Relief Act and Justice‘s appropriations for fiscal
years 2000 to 2003 and interviewed Justice officials. We reviewed a
copy of the interim report Justice submitted to Congress and of the
vulnerability assessment methodology developed by Justice and Sandia.
We requested a meeting with the Justice and Sandia personnel who were
directly involved with making the observations on facility security,
which was the basis for the interim report, but to date, Justice has
not provided us access to them. We performed our review from April 2002
through August 2002 in accordance with generally accepted government
auditing standards.
We are sending copies of this report to interested congressional
committees. We also will make copies available to others upon request.
In addition, the report will be available at no charge on the GAO Web
site at http://www.gao.gov.
If you have any questions about this report, please contact me at (202)
512-3841. Major contributors to this report were Linda Libician, Leigh
White, Amy Webbink, and Joanna McFarland.
John B. Stephenson:
Director, Natural Resources andEnvironment:
Signed by John B. Stephenson:
Enclosure:
Enclosure I:
Comments from the U.S. Department of Justice:
U.S. Department of Justice:
Washington, D.C 20530:
OCT - 3 2002:
Mr. John Stephenson:
Director, Natural Resources and Environment U.S. General Accounting
Office:
441 G Street, NW Washington, D.C.
Dear Mr. Stephenson:
Thank you for the opportunity to review the final draft of the General
Accounting Office (GAO) report, entitled ’Homeland Security: Justices‘s
Response to Its Congressional Mandate to Assess and Report on Chemical
Industry Vulnerabilities, GAO-02-1066R.“ This letter constitutes the
formal comments of the Department of Justice, and I request that it be
included in the final report.
The report makes a number of observations concerning the Department‘s
actions and statutory requirements to review and report on the
vulnerability of chemical facilities to a terrorist or criminal attack.
While the Department agrees with the majority of the observations
contained in the report, we believe the GAO observation that the
Department did not use available funds to address the comprehensive
reporting requirements included in the Chemical Safety Information,
Site Security and Fuels Regulatory Relief Act (CSISSFRRA) does not
place our efforts in the proper context. The report states that
’generally“ when Congress imposes a new requirement on an agency but
does not appropriate funds specifically to implement it, the agency
must use existing appropriations to fund the requirement. While as a
general matter this is true, the use of the Department‘s available
funding for new programs, projects, or activities not specifically
requested in a budget request or funded in an appropriations act is
restricted by Section 605 of our annual appropriations acts. Section
605(a) requires that the Committee on Appropriations be notified 15
days prior to the Department using any appropriated monies or monies
made available to the Department through the collection of fees, and
prior to using in excess of $500,000 or 10 percent, whichever is less.
The Department complied with Section 605 requirements in developing a
funding mechanism for the Congressionally-mandated study cited in your
report, and the proposal was then objected to by the Congress.
Since the early 1980‘s, the annual Commerce, Justice, and State, the
Judiciary and Related Agencies Appropriations Act has contained a
general provision that establishes by law how and when the Committees
on Appropriation are to be notified about changes in the way the
Department executes its budget. While the Committees recognize that
there will be changes during the operating year that may require a
different allocation of resources and changes in program emphasis as
priorities change, the Department is required by law to notify the
Committees of such changes.
Specifically, section 605(a) requires that the Committees on
Appropriations be notified 15 days prior to the Department using any
appropriated monies or monies made available to the Department through
the collection of fees (available in the current or any prior fiscal
year) to:
* Create a new program(s);
* Eliminate a program, project, or activity;
* Increase funds or personnel by any means for any project or activity
for which funds have been denied or restricted;
* Relocate an office or employees
* Reorganize offices, programs, or activities Contract out or privatize
any functions, or activities presently performed by Federal employees.
In addition, section 605(b) requires that the Committees on
Appropriations be notified 15 days prior to the Department using in
excess of $500,000 or 10 percent, whichever is less:
* To augment existing programs, projects or activities;
* To reduce by 10 percent funding for any existing program, project, or
activity, or numbers of personnel by 10 percent as approved by
Congress; or:
* That result from any general savings from a reduction in personnel
which would result in a change in existing programs, activities, or
projects as approved by both Houses of Congress.
Use of the Attorney General‘s Counterterrorism Fund, as the Department
proposed in its March 31, 2000 notification, are subject to the
requirements of Section 605. Thus, after Congress passed the CSISSFRRA,
the Department made efforts, consistent with law governing use of its
appropriations, to fund the required report. The notice informed
Congress of the Department‘s plans to transfer $750,000 from the
Attorney General‘s Counterterrorism Fund appropriation to the Office of
Justice Programs appropriation to develop a methodology. The
Appropriations Committees objected to the transfer, and the Department
did not proceed with it.
However, as mentioned in your report, in the Department‘s FY 2001
Appropriations Act, the Congress did provide $600,000 to develop, test,
and validate a prototype national Vulnerability Assessment (VA)
methodology for assessing the security of chemical facilities against
terrorist and criminal attacks, consistent with the requirements of PL
106-40 and to provide a comprehensive report on the findings derived
from the development of the VA methodology. This report was transmitted
to the Committees on Appropriations on May 28, 2002. In addition, the
first report required under CSISSFRRA was transmitted to the Congress
on May 30, 2002.
Finally, we recommend that the full discussion of the Department‘s
actions regarding funding of the study should be included under the
heading ’Justice Initiated Actions to Study the Vulnerability of the
Chemical Industry but Has Not Fully Met its Statutory Requirements,“
rather than under the next heading.
Again, we appreciate the GAO giving the Department an opportunity to
comment in this process and thank the Congress for its support in our
continuing efforts to improve our Homeland Security. If you have any
questions concerning the Department‘s comments you may contact Vickie
L. Sloan, Director, Audit Liaison Office on (202) 514-0469.
Sincerely,
Robert F. Diegelman:
Acting Assistant Attorney General for Administration:
Signed by Robert F. Diegelman:
FOOTNOTES
[1] We use the term ’chemical facilities“ in this report to mean those
stationary sources covered under section 112(r) of the Clean Air Act.
[2] Pub. L. No. 106-40, 113 Stat. 207 (1999).
[3] H.R. Conf. Rept. No. 106-1005, at 223 (2000).
[4] The Departments of Commerce, Justice, and State, the Judiciary, and
Related Agencies Appropriations Act for fiscal year 2001, Pub. L. No.
106-553, 114 Stat. 2762, was not enacted until December 21, 2000.
[5] See B-195007, July 15, 1980; 46 Comp. Gen. 604 (1967); 15 Comp.
Gen. 167 (1935).
[6] The October 2000 Conference report on Justice‘s appropriation act
for fiscal year 2001 directed this action. Additionally, the Conference
report required Justice to submit a report on the findings derived from
the development of the methodology. Justice submitted this report to
its appropriations committees in May 2002.
[7] Justice made this determination pursuant to 42 U.S.C.
7412(r)(7)(H)(xi)(III).
[8] We only discuss selected information from the interim report that
Justice has determined does not pose a threat to national security.
[9] However, CSISSFRRA authorizes such funds as may be necessary to be
appropriated to Justice to conduct the study and report on the
vulnerability of chemical facilities.
[10] Department of Justice, Fiscal Year 2003 Budget Summary, Salaries
and Expenses, General Administration, Department Leadership.
[11] See B-195007, July 15, 1980; 46 Comp. Gen. 604 (1967); 15 Comp.
Gen. 167(1935).
